1Several employees received emails that appeared to be from an online auction site
Phishing
2What is the most cost-effective way to defend against whaling attacks?
Educate and train upper management.
3Which two types of attacks rely mainly on the attacker seeming to be familiar to the victim for their effectiveness? (Choose two.)
Spear phishing : Tailgating
A security administrator is working on a confidential report in a crowded airport terminal. The administrator is not connected to the airport's Wi-Fi hotspot.
4What type of attack is MOST likely to occur?
Shoulder surfing
5A security analyst receives an email message that appears to be from the IT director at the company.
Impersonation
6A employee receives a direct message from a friend on a social network.
Trust : Scarcity
7A Chief Financial Officer (CFO) receives an email that appears to be from the company's President.
Whaling
8Which Chief Financial Officer (CFO) receives an email that appears to be from the company's President.
Bot
A user installs an application on a computer. After installing the application, the computer begins receiving a series of pop-up ads. The ads do not display after the user enables the popup blocker.
9What most likely occurred?
The application installed adware on the computer.
10You discover a program running in the background on a computer.
Spyware
11You download a file management application from the Internet. When you launch the application, your screen goes blank and your hard disk's active light starts flashing.
Trojan horse
A set of programs provide a hacker with administrator access to a computer that cannot be detected through normal means.
12What is the BEST description of this threat?
Rootkit
13Your network is attacked by a self-replicating program. What type of malware does this indicate?
Worm
An attacker is attempting to hack into a secure server. An insider provides the attacker with a file containing the server's hashed passwords. Company guidelines recommend using multiple word passwords.
14Which type of attack would be used to MOST quickly find passwords in the hashed password file?
Rainbow table attack
A developer is preparing to deploy an e-commerce website. The website uses dynamically generated web pages based on user input. This is a requirement for the application running on the website.
15The site must be designed to prevent cross-site scripting attacks. What should the developer do?
Implement user input validation.
16What can be done prevent an internet attacker from using a replay attack to gain access to a secure public website?
Timestamp session packets.
17A security administrator discovers attempts to compromise a Web site. The attacks are based on commands sent from authenticated users' Web browsers to the Web site. The commands execute at the user's permission level. Users who have been contacted had no idea that the commands were being sent from their computers.
Cross-site request forgery
18An attacker modified the custom error pages for a website through data input through a data form on the website. Error pages are dynamically generated when an error occurs, and the page is rendered containing a script that directs the user to a malicious website.
Cross-site scripting
19What is the primary risk of an integer overflow attack?
Arbitrary code execution
A company hosts a customer feedback forum on its website. Visitors are redirected to a different website after opening a recently posted comment.
20What kind of attack does this MOST likely indicate?
Cross-site scripting (XSS)
An organization discovers that some of its proprietary data is for sale on a dark web hacker site. As part of the incident response, a security administrator analyzes application and system logs on all Internet-facing servers. On one web server, the administrator observes the following text listed repeatedly in POST requests:
22When network users attempt to navigate to your company's public website, they are being redirected to a different website. This is an example of which type of attack?
DNS poisoning
23Some network traffic is being redirected to a client that is infected with a Trojan. The IP addresses and MAC addresses on the redirected packets do not match up correctly. All packets have the MAC address of the infected system. The IP addresses are legitimate host addresses.
ARP poisoning
24Which security goal is compromised by a DDoS attack?
availability
25Users report that they lose connection to the wireless access point. Radio frequencies that have a similar pattern to those transmitted by the access point are discovered.
Jamming
26Two devices communicate using NFC. Which attack represents the greatest vulnerability?
eavesdropping
27A segment of a company's network is periodically overwhelmed with traffic from an older network switch, causing communication problems.
MAC flooding
A user reports odd behavior when attempting to access network resources from their Windows laptop.
While reviewing the Host- Based Intrusion Detection System (HIDS) logs on the laptop, a security administrator discovers that files in the C:\windows\system32\drivers let directory have been modified.
28Which type of attack has the security administrator most likely uncovered?
DNS poisoning
29A script kiddie would most likely be involved in what type of activity?
Vandalizing public websites
30This is an actor whose primary goal is to either draw attention to a cause or reduce support for a cause rather than a monetary goal.
Hacktivist
31This is an actor primarily interested in covert collection of data and in performing acts of cyber espionage.
State-sponsored
32This is an actor that is best positioned to take advantage of a company's security and infrastructure in executing an attack.
Internal
33This is an actor that is motivated primarily by monetary gain, focusing on attacks such as ransomware and identity theft.
Organized crime
A company discovers that is has been under attack from an APT for several months.
34Through which type of attack was the initial breach most likely accomplished?
Spear fishing
35A group that wants to bring attention to an issue, person, or organization. The group's motivation is about making a point rather than financial gain.
Hacktivist
36This is a threat actor with minimal technical skills who relies on tools developed by others. Goals include hacking in just to hack in.
Script Kiddie
37A group whose primary goal is financial gain and relies on attacks such as ransomware and data exfiltration activities.
Organized crime
38A group that uses hard-to-detect tools to persist its connection to target systems, usually with data theft or financial gain as goals.
APT
39Involved in activities coming from malicious actions, negligence, or (incompetence by an organization's employees.
Insider threat
40Which of the following threat actors is MOST likely to be classified as an APT
State actors
41An organization collects extensive cyber threat intelligence (CTI) and would like to share this information with partners. Which of the following should the organization use when formatting and structuring this information?
STIX
42Which of the following uses infected removable media as an attack vector?
Baiting
43An attack occurred that leveraged a previously unknown vulnerability. The vendor is working on a corrective patch.
Zero day
44Successful social engineering attacks are increasing in a company, most of them based on deceptive telephone calls.
User training
45Recently installed routers have been reconfigured by an attacker who used administrative access to the routers.
Default configuration
46A web application that was developed in house has been found to be highly susceptible to buffer overflow and DoS attacks.
Design weakness
47What is the primary security concern regarding zero-day vulnerabilities?
The vulnerability goes unknown and undetected until after it is exploited.
A file server is deployed on a company's on-premises network. A security review finds that several ports open for services are not in use on the computer.
48What is the MOST likely risk associated with this?
The computer's attack surface is unnecessarily increased.
An map scan of open ports includes TCP ports 21, 22, 23, 80, 443, and 990.
49Which three ports indicate that unsecure protocols are in use on the computer?
21 : 23 : 80
50Which of the following provides the best protection against zero-day attacks?
Anomaly-based detection
51A security administrator discovers port 23 is open and actively used on many servers. Which of the following should be the administrator's PRIMARY concern?
Eavesdropping
52A security administrator discovers multiple network nodes sending and receiving command-and-control traffic followed by a spike in traffic. What is the MOST likely impact of this discovery?
Loss of availability
A company is developing a new, very large web application. Developers run periodic vulnerability scans.
The scans report multiple vulnerabilities. The developers have traced these to false positives from text on some of the web pages.
53What is the risk if this continues?
Developers may miss valid vulnerabilities.
54A company is comparing vulnerability scanning options. Which statement accurately describes a non-credentialed scan?
The scan is run from outside the target host system.
55Credentialed scans are less intrusive to the network than non-credentialed vulnerability scans.
Yes
56Credentialed and non-credentialed scans will report the same open ports on a host firewall.
No
57Credentialed scans are designed to find missing patches better than non-credentialed scans.
Yes
58Credentialed scans simulate an outside attacker better than non-credentialed scans.
No
A company needs a security solution consisting of a set of compatible security applications that:
• Collect and organize data from multiple sources.
• Define, prioritize, and automate incident response functions.
• Orchestrate workflows, policies, and reporting
• Automatically respond to low- level threats.
59Which security solution meets these requirements?
SOAR
60What is an advantage of a penetration tester running a non-credentialed scan instead of a credentialed scan?
A non-credentialed scan provides a penetration tester an outsider's view
61An organization struggles to manage and search logs stored on various servers and network nodes. Which platform provides log aggregation and can be used for log analysis and security assessments?
SIEM
As part of a security assessment, an organization must be able to rank vulnerabilities based on severity.
62Which of the following protocols or platforms should the organization use?
CVSS
A company is contracting with a third-party security company to perform penetration testing.
63Which two considerations are NOT defined in the rules of engagement? Select two.
Testing Goals : Targeted IP ranges and domains
A security company is contracted for black hat penetration testing at a large corporation. The security company relies only on publicly available information for its initial reconnaissance, and it does not attempt to contact the corporation or access the corporation's network or resources.
64What is this BEST described as?
OSINT
A penetration tester gains access to a computer running Windows Server 2016 that is deployed on a company's perimeter network. The server is configured as a VM host. The tester is able to compromise the host operating system.
65The tester wants to ensure the ability to gain access to the computer in the future. What should the tester use?
Persistence
A penetration tester discovers an exploitable vulnerability in a web application. One of the goals of the penetration test project is to test the company's internal incident response team's ability to detect and react to exploit attempts executed using real-world cyber-attack techniques.
66What type of team exercise should the penetration tester initiate?
Red team
A penetration tester's tools cause an out-of-scope web server to crash, leading to a prolonged outage.
67Which of the following documents, if followed by the tester, would
Rules of engagement
68Which of the following statements describes black box penetration
The tester has no information about the target environment.
69During which phase of a penetration test is the tester most likely to use OSINT?
Reconnaissance
70Which of the following is designed to be a full-scoped attack simulation?
Red team testing
Your organization has developed a fault-tolerant design to help ensure business continuity in case of a disaster. The disaster recovery site has mission-critical hardware already installed and connectivity already established. Data backups of critical data are on hand, but they may be up to a week old.
71This is an example of which of the following?
Warm site
A company's internal network has experienced several attempted attacks from the Internet. The administrator needs to collect as much information about the attackers and their attack methods as possible. The administrator should minimize the risk to the internal network.
72What should the administrator use?
Honeynet
73The company must ensure business continuity through use of an alternate processing location that supports its standard business processes in case of failure at the main site.
Hot site
74The company must have an alternate location available with the facilities infrastructure to support business operations. Costs must be kept to a minimum.
Cold site
75The company must be able to return to full operations as quickly as possible after a catastrophic failure. The site will maintain copies of all current backups.
Hot site
A company is concerned about users sending sensitive information to recipients outside of the network.
This is a concern due to potential insider threats and the need to meet stringent data privacy requirements.
76What should the company implement to help prevent this?
DLP
A company is designing its disaster recovery plan. The company wants potential down time after a disaster kept to a minimum. Data loss and reposting requirements should also be kept to a minimum. The ability to physically secure the site and prevent any outside entry is a primary concern
77What is the BEST disaster recovery site option?
Hot site
A security consultant is brought in to test recent changes made to a company's network by its in-house security personnel. The consultant discovered a file named passwd.cs that was located at the disk root on a web server deployed in the company's perimeter network. The web server runs Linux.
78What is the MOST likely reason for this file?
The file was placed there as a honeyfile by in-house security.
79To protect sensitive PHI, an organization plans to substitute random characters for original data, while maintaining the data's format. Which of the following technologies or methods should
Tokenization
An organization plans to contract with a provider for a disaster recovery site that will host server hardware
80When the primary data center fails, data will be restored, and the secondary site will be activated. Costs must be minimized. Which type of disaster recovery site should the organization
Warm site
A subscription to a productivity application allows users in a company to create and share documents. The service is not hosted on a dedicated server.
81What two things is this an example of? (Choose two.)
Public cloud : SaaS
82This model supplies an appropriate environment for developing, testing, and deploying applications. The provider is responsible for the operating system, development environment, and other resources.
Paas
83This model gives the user the most direct control over the environment. The subscriber is responsible for maintaining the operating system and other resources.
IaaS
84This model offers access to applications on a subscription or pay-as-you-go basis. The provider is responsible for upgrades and all management requirements except user preference settings.
SaaS
A company uses an internet of things (loT) processing solution that uses a distributed architecture with a large number of distributed nodes to support smart buildings. Short-term analytic processing occurs at the local area network (LAN) level, providing quick results and low latency data transfers to gateway devices.
Processing can occur when no internet bandwidth is immediately available
85Which computer model does this describe?
Fog computing
86Which cloud service model provides servers, storage, and network infrastructure but not operating systems or applications?
IaaS
87Which of the following is also known as a Type 1 hypervisor?
Bare metal
88An organization deploys web services on a custom, hardened OS. The organization plans to move most of its operations to the cloud. Which of the following models should the organization select?
IaaS
89An organization has migrated its primary application from a monolithic stack to a microservices architecture. Which of the following is the primary benefit of this migration?
The application can scale to meet increased demand.
A server application is currently under development. It has been discovered that some errors, such as a divide by zero error, can leave the application running in an unstable condition. The application needs to respond more appropriately to errors and generate an error message when they occur.
90What should the developers implement? (Choose the BEST answer.)
Exception handling
91Which server acts as a mirror of the real environment and is used by developers to test and finalize new software prior to rollout?
Staging
92What is the role of OWASP in software development?
OWASP provides free materials to promote and support web application security.
A company recently started using an agile development methodology and is making extensive use of automation in testing and in managing the development and deployment process
The company uses a software engineering practice where development is completed in incremental chunks and held in a staging environment until manually released
93What is this an example of?
Continuous delivery
94An organization determines that their working production control is susceptible to attack. What should the organization implement to mitigate the risk of compromised code integrity?
Version control
95Which process ensures that code vulnerabilities can be patched and updated code placed into production as quickly as possible?
CI/CD
96Which of the following statements describes a benefit of implementing stored procedures
Mitigation of injection attacks
A company needs to set up two-factor authentication for a cloud-based application. The authentication should include a one-time use, limited time password that is delivered to the user through the Google Authenticator mobile app. The password should be based on a shared key and the current date and time.
97What type of authentication should the company use?
TOTP
A user arrives at a datacenter and is challenged by three authentication methods as shown in the exhibit.
98What is the BEST description of the multifactor authentication policy that is in use?
The authentication depends on something he has, something he is, and somewhere he is.
A user arrives at a datacenter and is challenged by three authentication methods as shown in the exhibit.
99What is the BEST description of the multifactor authentication policy that is in use?
The authentication depends on something he has, something he is, and somewhere he is.
100Which are valid examples of multifactor MA requirements? (Choose two.)
Retina scan and password : Smart card and PIN
A company is designing and developing an automated authentication system based on biometric attributes
101One of the goals is to keep the authentication process as transparent and unobtrusive to employees as possible
Gait : Facial
102To reduce management complexity and increase operational security, an organization plans to deploy AAA services. Which of the following platforms or technologies will help the organization meet this goal?
RADIUS
103An organization recently deployed a biometric authentication system. Which of the following should the organization use as its primary tuning metric?
Crossover error rate
104Which statement describes a primary benefit provided by MFA?
Mitigation of phishing attacks
105A system has six 100 GB hard disks available for data storage. Which RAID configuration will provide the most available storage with fault tolerance?
RAID-5
106A network administrator backs up the server by using an incremental backup strategy. He uses seven tapes, one tape per day, and he performs the backup at the end of each business day. He does a full backup on Friday and Tuesday and an incremental on the other days (Sunday, Monday, Wednesday, Thursday, and Saturday).
2
An administrator sets up a VM for testing different versions of an application. The administrator wants to be able to return to the baseline state as quickly as possible between each test.
107What should the administrator do?
Create a snapshot of the VM.
A company has a database that is used to store product inventory. The cost to the company is very high if the database is not available.
108Which two technology controls could be used to improve the database's availability? (Choose two.)
RAID / Clustering
109What is an advantage of implementing a policy of control diversity in a network?
An attack is less likely to impact multiple devices.
110What are two advantages of implementing a vendor diversity policy? (Choose
Reduced equipment costs : Access to the most recent technologies
111The administrator deploys three web servers, all hosting the same web application and data, on his company's perimeter network. The administrator implements load balancing through the use of a load balancer.
High availability
112A company deploys a highly advanced HVAC system in a datacenter. Which two security measures should a security specialist recommend for that system? (Choose two.)
Install cameras and alarms. : Isolate HVAC management devices.
113Which type of system is MOST susceptible to costly and possibly catastrophic failures caused by operator errors?
SCADA
114Which is NOT a vulnerability associated with embedded systems?
The operating system versions used are unstable and difficult
115A company is deploying loT devices on its production network. What are two vulnerabilities that can place the network at greater risk?
Devices use hard-coded or well-known default passwords : Devices do not have the computing resources to implement advanced security.
116An organization deploys a MODBUS based SCADA system to manage production machinery. Which of the following methods should be the organization's first choice for securing
NGFW
117An organization plans to deploy remote loT devices that will monitor environmental conditions. Due to processing constraints, the devices do not support PKI, but the organization is concerned that stored secrets might be easily compromised if a device is stolen. Which of the following can be used to mitigate this risk?
TPM
118An organization prepares to deploy specialized medical systems that will remotely collect and monitor health information from each patient's home.
Deploy X.509 certificates on organization web servers.
119A security administrator is designing physical security for network servers. The design requirements call for the servers to be kept in a locked room with limited physical access. The administrator wants to ensure that physical access is controlled as tightly as possible and prevent unauthorized access
Secure the room with a biometric-based lock.
120Which of the following can be used to prevent external electrical fields from affecting
Faraday cage
A security administrator is looking for a method to manage access to a secure area. They want to allow entry through a locked gate that unlocks automatically and track individuals going into and out of the area.
121Which method should the administrator use?
Proximity reader
A security administrator is looking for a way to know when people approach any of several secure areas.
The method must be active 24-hours a day. They want to keep recurring expenses related to the solution to a minimum.
122What should the administrator use?
Video surveillance
A company has an office on the fifth floor of a building in a city that is prone to earthquakes. Earthquakes have been identified as the most important risk to mitigate.
123Which risk mitigation controls would be most important when ensuring employee safety? (Choose
Emergency lighting
Drills
Escape plans
A company needs to ensure that, if anyone enters the server room after hours, the doors are locked and cannot be opened from the inside. The company wants to minimize the recurring costs related to the solution.
124What should the company install?
Motion detector
125Which of the following physical controls is the best option for mitigating tailgating attacks?
Mantrap
A security administrator discovers that company confidential information is being encoded into graphics files and sent to a destination outside of the company.
126This is an example of which kind of cryptography?
Steganography