CompTIA CASP+ CAS-003 Exam Questions have been Updated

1. A new cluster of virtual servers has been set up in a lab environment and must be audited before being allowed on the production network. The security manager needs to ensure unnecessary services are disabled and all system accounts are using strong credentials.

Which of the following tools should be used? (Choose two.)

2. A technician is configuring security options on the mobile device manager for users who often utilize public Internet connections while travelling.

After ensuring that full disk encryption is enabled, which of the following security measures should the technician take? (Choose two.)

3. The director of sales asked the development team for some small changes to increase the usability of an application used by the sales team. Prior security reviews of the code showed no significant vulnerabilities, and since the changes were small, they were given a peer review and then pushed to the live environment. Subsequent vulnerability scans now show numerous flaws that were not present in the previous versions of the code .

Which of the following is an SDLC best practice that should have been followed?

4. A recent security assessment revealed a web application may be vulnerable to clickjacking. According to the application developers, a fix may be months away .

Which of the following should a security engineer configure on the web server to help mitigate the issue?

5. A financial services company has proprietary trading algorithms, which were created and are maintained by a team of developers on their private source code repository. If the details of this operation became known to competitors, the company's ability to profit from its trading would disappear immediately .

Which of the following would the company MOST likely use to protect its trading algorithms?

6. A software development company lost customers recently because of a large number of software issues. These issues were related to integrity and availability defects, including buffer overflows, pointer deferences, and others .

Which of the following should the company implement to improve code quality? (Select two).

7. A Chief Information Security Officer (CISO) recently changed jobs into a new industry. The CISO’s first task is to write a new, relevant risk assessment for the organization .

Which of the following help to the CISO find relevant risks to the organization? (Choose two.)

8. The finance department has started to use a new payment system that requires strict PII security restrictions on various network devices. The company decides to enforce the restrictions and configure all devices appropriately .

Which of the following risk response strategies is being used?

9. A company has created a policy to allow employees to use their personally owned devices. The Chief Information Officer (CISO) is getting reports of company data appearing on unapproved forums and an increase in theft of personal electronic devices .

Which of the following security controls would BEST reduce the risk of exposure?

10. A government contracting company issues smartphones to employees to enable access to corporate

resources. Several employees will need to travel to a foreign country for business purposes and will require access to their phones. However, the company recently received intelligence that its intellectual property is highly desired by the same country’s government .

Which of the following MDM configurations would BEST reduce the risk of compromise while on foreign soil?

11. The risk subcommittee of a corporate board typically maintains a master register of the most prominent risks to the company. A centralized holistic view of risk is particularly important to the corporate Chief Information Security Officer (CISO) because:

12. Ann, a user' brings her laptop to an analyst after noticing it has been operating very slowly.

The security analyst examines the laptop and obtains the following output.





Which of the following will the analyst most likely use NEXT?

13. A system administrator at a medical imaging company discovers protected health information (PHI) on a general-purpose file server .

Which of the following steps should the administrator take NEXT?

14. An organization relies heavily on third-party mobile applications for official use within a BYOD deployment scheme.

An excerpt from an approved text-based-chat client application AndroidManifest.xml is as follows:





Which of the following would restrict application permissions while minimizing the impact to normal device operations?

15. An information security manager is concerned that connectivity used to configure and troubleshoot critical network devices could be attacked.

The manager has tasked a network security engineer with meeting the following requirements:

✑ Encrypt all traffic between the network engineer and critical devices.

✑ Segregate the different networking planes as much as possible.

✑ Do not let access ports impact configuration tasks.

Which of the following would be the BEST recommendation for the network security engineer to present?

16. A secure facility has a server room that currently is controlled by a simple lock and key. and several administrators have copies of the key. To maintain regulatory compliance, a second lock, which is controlled by an application on the administrators' smartphones, is purchased and installed. The application has various authentication methods that can be used.

The criteria for choosing the most appropriate method are:

• It cannot be invasive to the end user

• It must be utilized as a second factor.

• Information sharing must be avoided

• It must have a low false acceptance rate.

Which of the following BEST meets the criteria?

17. A company wants to configure its wireless network to require username and password authentication .

Which of the following should the system administrator implement?

18. Which of the following may indicate a configuration item has reached end-of-life?

19. A forensic analyst suspects that a buffer overflow exists in a kernel module.

The analyst executes the following command:

dd if=/dev/ram of=/tmp/mem/dmp

The analyst then reviews the associated output:

^34^#AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/bin/bash^21^03#45

However, the analyst is unable to find any evidence of the running shell .

Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?

20. A consultant is hired to perform a passive vulnerability assessment of a company to determine what information might be collected about the company and its employees. The assessment will be considered successful if the consultant can discover the name of one of the IT administrators .

Which of the following is MOST likely to produce the needed information?

21. A health company has reached the physical and computing capabilities in its datacenter, but the computing demand continues to increase. The infrastructure is fully virtualized and runs custom and commercial healthcare application that process sensitive health and payment information .

Which of the following should the company implement to ensure it can meet the computing demand while complying with healthcare standard for virtualization and cloud computing?

22. Which of the following is a feature of virtualization that can potentially create a single point of failure?

23. A developer has executed code for a website that allows users to search for employees’ phone numbers by last name.

The query string sent by the browser is as follows:

http://www.companywebsite.com/search.php?q=SMITH

The developer has implemented a well-known JavaScript sanitization library and stored procedures, but a

penetration test shows the website is vulnerable to XSS .

Which of the following should the developer implement NEXT to prevent XSS? (Choose two.)

24. While traveling to another state, the Chief Financial (CFO) forgot to submit payroll for the company. The CFO quickly gained to the corporate through the high-speed wireless network provided by the hotel and completed the desk. Upon returning from the business trip, the CFO was told no one received their weekly pay due to a malware on attack on the system .

Which of the following is the MOST likely of the security breach?

25. A deployment manager is working with a software development group to assess the security of a new version of the organization’s internally developed ERP tool. The organization prefers to not perform assessment activities following deployment, instead focusing on assessing security throughout the life cycle .

Which of the following methods would BEST assess the security of the product?

26. An organization is improving its web services to enable better customer engagement and self-service. The organization has a native mobile application and a rewards portal provided by a third party. The business wants to provide customers with the ability to log in once and have SSO between each of the applications. The integrity of the identity is important so it can be propagated through to back-end systems to maintain a consistent audit trail .

Which of the following authentication and authorization types BEST meet the requirements? (Choose two.)

27. A security administrator is hardening a TrustedSolaris server that processes sensitive data.

The data owner has established the following security requirements:

✑ . The data is for internal consumption only and shall not be distributed to outside individuals

✑ . The systems administrator should not have access to the data processed by the server

✑ . The integrity of the kernel image is maintained

Which of the following host-based security controls BEST enforce the data owner’s requirements? (Choose three.)

28. A security engineer is looking at a DNS server following a known incident.

The engineer sees the following command as the most recent entry in the server's shell history:

dd if=dev/sda of=/dev/sdb

Which of the following MOST likely occurred?

29. A threat advisory alert was just emailed to the IT security staff. The alert references specific types of host operating systems that can allow an unauthorized person to access files on a system remotely. A fix was recently published, but it requires a recent endpoint protection engine to be installed prior to running the fix.

Which of the following MOST likely need to be configured to ensure the system are mitigated accordingly? (Select two.)

30. A user asks a security practitioner for recommendations on securing a home network. The user recently purchased a connected home assistant and multiple IoT devices in an effort to automate the home. Some of the IoT devices are wearables, and other are installed in the user’s automobiles. The current home network is configured as a single flat network behind an ISP-supplied router. The router has a single IP address, and the router performs NAT on incoming traffic to route it to individual devices.

Which of the following security controls would address the user’s privacy concerns and provide the BEST level of security for the home network?

31. Which of the following BEST sets expectation between the security team and business units within an organization?

32. As part of the asset management life cycle, a company engages a certified equipment disposal vendor to appropriately recycle and destroy company assets that are no longer in use.

As part of the company’s vendor due diligence, which of the following would be MOST important to obtain from the vendor?

33. A Chief Information Security Officer (CISO) requests the following external hosted services be scanned for malware, unsecured PII, and healthcare data:

✑ Corporate intranet site

✑ Online storage application

✑ Email and collaboration suite

Security policy also is updated to allow the security team to scan and detect any bulk downloads of corporate data from the company’s intranet and online storage site .

Which of the following is needed to comply with the corporate security policy and the CISO’s request?

34. A security analyst who is concerned about sensitive data exfiltration reviews the following:





Which of the following tools would allow the analyst to confirm if data exfiltration is occuring?

35. Due to a recent breach, the Chief Executive Officer (CEO) has requested the following activities be conducted during incident response planning:

✑ Involve business owners and stakeholders

✑ Create an applicable scenario

✑ Conduct a biannual verbal review of the incident response plan

✑ Report on the lessons learned and gaps identified

Which of the following exercises has the CEO requested?

36. An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes. The machine is running a very recent release of the Linux OS.

Which of the following technical approaches would be the MOST feasible way to accomplish this capture?

37. DRAG DROP

A security administrator must configure the database server shown below to comply with the four requirements listed.

Drag and drop the appropriate ACL that should be configured on the database server to its corresponding requirement. Answer options may be used once or not at all.

38. A technician is validating compliance with organizational policies. The user and machine accounts in the AD are not set to expire, which is non-compliant .

Which of the following network tools would provide this type of information?

39. A medical facility wants to purchase mobile devices for doctors and nurses. To ensure accountability, each individual will be assigned a separate mobile device.

Additionally, to protect patients’ health information, management has identified the following requirements:

✑ Data must be encrypted at rest.

✑ . The device must be disabled if it leaves the facility.

✑ . The device must be disabled when tampered with.

Which of the following technologies would BEST support these requirements? (Select two.)

40. Engineers at a company believe a certain type of data should be protected from competitors, but the data owner insists the information is not sensitive. An information security engineer is implementing controls to secure the corporate SAN. The controls require dividing data into four groups: non-sensitive, sensitive but accessible, sensitive but export-controlled, and extremely sensitive .

Which of the following actions should the engineer take regarding the data?

41. An electric car company hires an IT consulting company to improve the cybersecurity of us vehicles .

Which of the following should achieve the BEST long-term result for the company?

42. A red team is able to connect a laptop with penetration testing tools directly into an open network port. The team then is able to take advantage of a vulnerability on the domain controller to create and promote a new enterprise administrator .

Which of the following technologies would MOST likely eliminate this attack vector m the future?

43. A security analyst, who is working in a Windows environment, has noticed a significant amount of IPv6 traffic originating from a client, even though IPv6 is not currently in use. The client is a stand-alone device, not connected to the AD that manages a series of SCADA devices used for manufacturing .

Which of the following is the appropriate command to disable the client’s IPv6 stack?

A)





B)





C)





D)

44. After several industry comnpetitors suffered data loss as a result of cyebrattacks, the Chief Operating Officer (COO) of a company reached out to the information security manager to review the organization’s security stance.

As a result of the discussion, the COO wants the organization to meet the following criteria:

✑ Blocking of suspicious websites

✑ Prevention of attacks based on threat intelligence

✑ Reduction in spam

✑ Identity-based reporting to meet regulatory compliance

✑ Prevention of viruses based on signature

✑ Protect applications from web-based threats

Which of the following would be the BEST recommendation the information security manager could make?

45. A university’s help desk is receiving reports that Internet access on campus is not functioning. The network administrator looks at the management tools and sees the 1Gbps Internet is completely saturated with ingress traffic.

The administrator sees the following output on the Internet router:





The administrator calls the university’s ISP for assistance, but it takes more than four hours to speak to a network engineer who can resolve the problem.

Based on the information above, which of the following should the ISP engineer do to resolve the issue?

46. A company enlists a trusted agent to implement a way to authenticate email senders positively.

Which of the following is the BEST method for the company to prove Vie authenticity of the message?

47. CORRECT TEXT

48. A company has made it a spending priority to implement security architectures that will be resilient during an attack. Recent incidents have involved attackers leveraging latent vulnerabilities in cryptographic implementations and VPN concentrators to be able to compromise sensitive information. Patches have been slowly released for these emergent vulnerabilities, leaving weeks to months of exposed and vulnerable attack surface .

Which of the following approaches would be BEST to increase enterprise resilience during similar

future attacks?

49. While investigating suspicious activity on a server, a security administrator runs the following report:





In addition, the administrator notices changes to the /etc/shadow file that were not listed in the report .

Which of the following BEST describe this scenario? (Choose two.)

50. A security is assisting the marketing department with ensuring the security of the organization’s social media platforms. The two main concerns are:

The Chief marketing officer (CMO) email is being used department wide as the username

The password has been shared within the department

Which of the following controls would be BEST for the analyst to recommend?

51. A new security policy states all wireless and wired authentication must include the use of certificates when connecting to internal resources within the enterprise LAN by all employees.

Which of the following should be configured to comply with the new security policy? (Choose two.)

52. A cybersecurity analyst created the following tables to help determine the maximum budget amount the business can justify spending on an improved email filtering system:









Which of the following meets the budget needs of the business?

53. A financial consulting firm recently recovered from some damaging incidents that were associated with malware installed via rootkit. Post-incident analysis is ongoing, and the incident responders and systems administrators are working to determine a strategy to reduce the risk of recurrence. The firm’s systems are running modern operating systems and feature UEFI and TPMs .

Which of the following technical options would provide the MOST preventive value?

54. An external red team member conducts a penetration test, attempting to gain physical access to a large organization's server room in a branch office. During reconnaissance, the red team member sees a clearly marked door to the server room, located next to the lobby, with a tumbler lock.

Which of the following is BEST for the red team member to bring on site to open the locked door as quickly as possible without causing significant damage?

55. Ann, a security manager, is reviewing a threat feed that provides information about attacks that allow a malicious user to gain access to private contact lists. Ann receives a notification that the vulnerability can be exploited within her environment.

Given this information, Ann can anticipate an increase in:

56. Over the last 90 days, many storage services has been exposed in the cloud services environments, and the security team does not have the ability to see is creating these instance. Shadow IT is creating data services and instances faster than the small security team can keep up with them. The Chief information security Officer (CIASO) has asked the security officer (CISO) has asked the security lead architect to architect to recommend solutions to this problem.

Which of the following BEST addresses the problem best address the problem with the least amount of administrative effort?

57. A security analyst is reviewing the following pseudo-output snippet after running the command less /tmp/file,tmp.





The information above was obtained from a public-facing website and used to identify military assets .

Which of the following should be implemented to reduce the risk of a similar compromise?

58. A company's Chief Information Security Officer (CISO) is working with the product owners to perform a business impact assessment. The product owners provide feedback related to the critically of various business processes, personal, and technologies.

Transitioning into risk assessment activities, which of the following types of information should the CISO require to determine the proper risk ranking? (Select TWO).

59. A firewall specialist has been newly assigned to participate in red team exercises and needs to ensure the skills represent real-world threats .

Which of the following would be the BEST choice to help the new team member learn bleeding-edge techniques?

60. One of the objectives of a bank is to instill a security awareness culture .

Which of the following are techniques that could help to achieve this? (Choose two.)

61. An organization is attempting to harden its web servers and reduce the information that might be disclosed by potential attackers. A security anal... reviewing vulnerability scan result from a recent web server scan.

Portions of the scan results are shown below:

Finding# 5144322

First time detected 10 nov 2015 09:00 GMT_0600

Last time detected 10 nov 2015 09:00 GMT_0600

CVSS base: 5

Access path: http://myorg.com/mailinglist.htm

Request: GET http://mailinglist.aspx?content=volunteer

Response: C:DocmentsMarySmithmalinglist.pdf

Which of the following lines indicates information disclosure about the host that needs to be remediated?

62. Which of the following are the MOST likely vectors for the unauthorized or unintentional inclusion of vulnerable code in a software company’s final software releases? (Choose two.)

63. Company A is establishing a contractual with Company B. The terms of the agreement are formalized in a document covering the payment terms, limitation of liability, and intellectual property rights .

Which of the following documents will MOST likely contain these elements?

64. An organization, which handles large volumes of PII, allows mobile devices that can process, store, and transmit PII and other sensitive data to be issued to employees. Security assessors can demonstrate recovery and decryption of remnant sensitive data from device storage after MDM issues a successful wipe command.

Assuming availability of the controls, which of the following would BEST protect against the loss of sensitive data in the future?

65. A security engineer is helping the web developers assess a new corporate web application.

The application will be Internet facing so the engineer makes the following recommendation:

In an htaccess file or the site config add:

or add to the location block:





Which of the following is the security engineer trying to accomplish via cookies? (Select TWO)

66. Malware detection times would decrease due to third-party management of the service.

67. A security administrator is updating corporate policies to respond to an incident involving collusion between two systems administrators that went undetected for more than six months.

Which of the following policies would have MOST likely uncovered the collusion sooner? (Choose two.)

68. Access to the corporate applications

Which of the following solution components should be deployed to BEST meet the requirements? (Select three.)

69. Given the following information about a company’s internal network:

User IP space: 192.168.1.0/24

Server IP space: 192.168.192.0/25

A security engineer has been told that there are rogue websites hosted outside of the proper server space, and those websites need to be identified .

Which of the following should the engineer do?

70. A security engineer at a company is designing a system to mitigate recent setbacks caused competitors that are beating the company to market with the new products. Several of the products incorporate propriety enhancements developed by the engineer’s company. The network already includes a SEIM and a NIPS and requires 2FA for all user access .

Which of the following system should the engineer consider NEXT to mitigate the associated risks?

71. The security configuration management policy states that all patches must undergo testing procedures before being moved into production. The sec… analyst notices a single web application server has been downloading and applying patches during non-business hours without testing. There are no apparent adverse reaction, server functionality does not seem to be affected, and no malware was found after a scan .

Which of the following action should the analyst take?

72. The Chief Executive Officer (CEO) of a small startup company has an urgent need for a security policy and assessment to address governance, risk management, and compliance. The company has a resource-constrained IT department, but has no information security staff. The CEO has asked for this to be completed in three months.

Which of the following would be the MOST cost-effective solution to meet the company’s needs?

73. A Chief Security Officer (CSO) is reviewing the organization’s incident response report from a recent incident.

The details of the event indicate:

✑ A user received a phishing email that appeared to be a report from the organization’s CRM tool.

✑ . The user attempted to access the CRM tool via a fraudulent web page but was unable to access the tool.

✑ . The user, unaware of the compromised account, did not report the incident and continued to use the CRM tool with the original credentials.

✑ Several weeks later, the user reported anomalous activity within the CRM tool.

✑ Following an investigation, it was determined the account was compromised and

an attacker in another country has gained access to the CRM tool.

✑ Following identification of corrupted data and successful recovery from the incident, a lessons learned activity was to be led by the CSO.

Which of the following would MOST likely have allowed the user to more quickly identify the unauthorized use of credentials by the attacker?

74. During an audit, it was determined from a sample that four out of 20 former employees were still accessing their email accounts. An information security analyst is reviewing the access to determine if the audit was valid.

Which of the following would assist with the validation and provide the necessary documentation to audit?

75. A penetration tester is trying to gain access to a remote system. The tester is able to see the secure login page and knows one user account and email address, but has not yet discovered a password.

Which of the following would be the EASIEST method of obtaining a password for the known account?

76. An organization implemented a secure boot on its most critical application servers which produce content and capability for other consuming servers A recent incident, however led the organization to implement a centralized attestation service for these critical servers .

Which of the following MOST likely explains the nature of the incident that caused the organization to implement this remediation?

77. An attacker exploited an unpatched vulnerability in a web framework, and then used an application service account that had an insecure configuration to download a rootkit. The attacker was unable to obtain root privileges Instead the attacker then downloaded a crypto-currency mining program and subsequently was discovered. The server was taken offline, rebuilt, and patched .

Which of the following should the security engineer suggest to help prevent a similar scenario in the future?

78. A security engineer is designing a system in which offshore, outsourced staff can push code from the development environment to the production environment securely. The security engineer is concerned with data loss, while the business does not want to slow down its development process .

Which of the following solutions BEST balances security requirements with business need?

79. A DevOps team wants to move production data into the QA environment for testing. This data contains credit card numbers and expiration dates that are not tied to any individuals. The security analyst wants to reduce risk .

Which of the following will lower the risk before moving the data?

80. During a routine network scan, a security administrator discovered an unidentified service running on a new embedded and unmanaged HVAC controller, which is used to monitor the company's datacenter

Port state

161/UDP open

162/UDP open

163/TCP open

The enterprise monitoring service requires SNMP and SNMPTRAP connectivity to operate .

Which of the following should the security administrator implement to harden the system?

81. A company recently migrated to a SaaS-based email solution.

The solution is configured as follows.

• Passwords are synced to the cloud to allow for SSO

• Cloud-based antivirus is enabled

• Cloud-based anti-spam is enabled

• Subscription-based blacklist is enabled

Although the above controls are enabled, the company's security administrator is unable to detect an account compromise caused by phishing attacks in a timely fashion because email logs are not immediately available to review .

Which of the following would allow the company to gam additional visibility and reduce additional costs? (Select TWO)

82. Which of the following attacks can be used to exploit a vulnerability that was created by untrained users?

83. During the migration of a company’s human resources application to a PaaS provider, the Chief Privacy Officer (CPO) expresses concern the vendor’s staff may be able to access data within the migrating applications. The application stack includes a multitier architecture and uses commercially available, vendor-supported software packages .

Which of the following BEST addresses the CPO’s concerns?

84. Which of the following BEST represents a risk associated with merging two enterprises during an acquisition?

85. DRAG DROP

Drag and drop the cloud deployment model to the associated use-case scenario. Options may be used only once or not at all.

86. Two competing companies experienced similar attacks on their networks from various threat actors. To improve response times, the companies wish to share some threat intelligence about the sources and methods of attack.

Which of the following business documents would be BEST to document this engagement?

87. A security analyst has been assigned incident response duties and must instigate the response on a Windows device that appears to be compromised .

Which of the following commands should be executed on the client FIRST?

A)





B)





C)





D)

88. A company’s Chief Operating Officer (COO) is concerned about the potential for competitors to infer proprietary information gathered from employees’ social media accounts.

Which of the following methods should the company use to gauge its social media threat level without targeting individual employees?

89. DRAG DROP

A vulnerability scan with the latest definitions was performed across Sites A and B.

Match each relevant finding to the affected host-After associating the finding with the appropriate host(s), click the host to select the appropriate corrective action for that finding.

90. To meet a SLA, which of the following documents should be drafted, defining the company’s internal interdependent unit responsibilities and delivery timelines.

91. A project manager is working with system owners to develop maintenance windows for system pathing and upgrades in a cloud-based PaaS environment. Management has indicated one maintenance windows will be authorized per month, but clients have stated they require quarterly maintenance windows to meet their obligations .

Which of the following documents should the project manager review?

92. CORRECT TEXT

An administrator wants to install a patch to an application.

INSTRUCTIONS

Given the scenario, download, verify, and install the patch in the most secure manner.

The last install that is completed will be the final submission.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

93. A recent penetration test identified that a web server has a major vulnerability. The web server hosts a critical shipping application for the company and requires 99.99% availability. Attempts to fix the vulnerability would likely break the application. The shipping application is due to be replaced in the next three months .

Which of the following would BEST secure the web server until the replacement web server is ready?

94. A Chief Information Security Officer (CISO) implemented MFA for all accounts in parallel with the BYOD policy. After the implementation, employees report the increased authentication method is causing increased time to tasks. This applies both to accessing the email client on the workstation and the online collaboration portal .

Which of the following should be the CISO implement to address the employees’ concerns?

95. A penetration tester is conducting an assessment on Comptia.org and runs the following command from a coffee shop while connected to the public Internet:





Which of the following should the penetration tester conclude about the command output?

96. After embracing a BYOD policy, a company is faced with new security challenges from unmanaged mobile devices and laptops.

The company’s IT department has seen a large number of the following incidents:

✑ Duplicate IP addresses

✑ Rogue network devices

✑ Infected systems probing the company’s network

Which of the following should be implemented to remediate the above issues? (Choose two.)

97. The Chief Information Security Officer (CISO) is preparing a requirements matrix scorecard for a new security tool the company plans to purchase Feedback from which of the following documents will provide input for the requirements matrix scorecard during the vendor selection process?

98. A company’s user community is being adversely affected by various types of emails whose authenticity cannot be trusted. The Chief Information Security Officer (CISO) must address the problem.

Which of the following solutions would BEST support trustworthy communication solutions?

99. A security administrator is advocating for enforcement of a new policy that would require employers with privileged access accounts to undergo periodic inspections and review of certain job performance data.

To which of the following policies is the security administrator MOST likely referring?

100. Which of the following is an external pressure that causes companies to hire security assessors and penetration testers?

101. A consulting firm was hired to conduct assessment for a company.

During the first stage, a penetration tester used a tool that provided the following output:

TCP 80 open

TCP 443 open

TCP 1434 filtered

The penetration tester then used a different tool to make the following requests:

GET / script/login.php?token=45$MHT000MND876

GET / script/login.php?token=@#984DCSPQ%091DF

Which of the following tools did the penetration tester use?

102. A company has gone through a round of phishing attacks. More than 200 users have had their workstation infected because they clicked on a link in an email. An incident analysis has determined an executable ran and compromised the administrator account on each workstation. Management is demanding the information security team prevent this from happening again .

Which of the following would BEST prevent this from happening again?

103. An organization's mobile device inventory recently provided notification that a zero-day vulnerability was identified in the code used to control the baseband of the devices. The device manufacturer is expediting a patch, but the rollout will take several months Additionally several mobile users recently returned from an overseas trip and report their phones now contain unknown applications, slowing device performance Users have been unable to uninstall these applications, which persist after wiping the devices.

Which of the following MOST likely occurred and provides mitigation until the patches are released?

104. A company is in the process of re-architecting its sensitive system infrastructure to take advantage of on-demand computing through a public cloud provider. The system to be migrated is sensitive with respect to latency availability, and integrity.

The infrastructure team agreed to the following

• Application and middleware servers will migrate to the cloud " Database servers will remain on-site

• Data backup wilt be stored in the cloud

Which of the following solutions would ensure system and security requirements are met?

105. A security administrator is opening connectivity on a firewall between Organization A and Organization B Organization B just acquired Organization A .

Which of the following risk mitigation strategies should the administrator implement to reduce the risk involved with this change?

106. An information security officer is responsible for one secure network and one office network. Recent intelligence suggests there is an opportunity for attackers to gain access to the secure network due to similar login credentials across networks.

To determine the users who should change their information, the information security officer uses a tool to scan a file with hashed values on both networks and receives the following data:





Which of the following tools was used to gather this information from the hashed values in the file?

107. An attacker has been compromising banking institution targets across a regional area. The Chief Information Security Officer (CISO) at a local bank wants to detect and prevent an attack before the bank becomes a victim .

Which of the following actions should the CISO take?

108. Legal counsel has notified the information security manager of a legal matter that will require the preservation of electronic records for 2000 sales force employees. Source records will be email, PC, network shares, and applications.

After all restrictions have been lifted, which of the following should the information manager review?

109. A developer implement the following code snippet.





Which of the following vulnerabilities does the code snippet resolve?

110. A company has completed the implementation of technical and management controls as required by its adopted security, ponies and standards. The implementation took two years and consumed s the budget approved to security projects. The board has denied any further requests for additional budget .

Which of the following should the company do to address the residual risk?

111. A company uses an application in its warehouse that works with several commercially available tablets and can only be accessed inside the warehouse. The support department would like the selection of tablets to be limited to three models to provide better support and ensure spares are on hand. Users often keep the tablets after they leave the department, as many of them store personal media items.

Which of the following should the security engineer recommend to meet these requirements?

112. An organization is currently working with a client to migrate data between a legacy ERP system and a cloud-based ERP tool using a global PaaS provider. As part of the engagement, the organization is performing data deduplication and sanitization of client data to ensure compliance with regulatory requirements .

Which of the following is the MOST likely reason for the need to sanitize the client data? (Choose two.)

113. 5 exit

Which of the following security concerns is evident in the above pseudocode?

114. A security consultant is improving the physical security of a sensitive site and takes pictures of the unbranded building to include in the report. Two weeks later, the security consultant misplaces the phone, which only has one hour of charge left on it. The person who finds the phone removes the MicroSD card in an attempt to discover the owner to return it.

The person extracts the following data from the phone and EXIF data from some files:

DCIM Images folder

Audio books folder

Torrentz

My TAX.xls

Consultancy HR Manual.doc

Camera: SM-G950F

Exposure time: 1/60s

Location: 3500 Lacey Road USA

Which of the following BEST describes the security problem?

115. The Chief Executive Officer (CEO) of a company has considered implementing a cost-saving measure that might result in new risk to the company.

When deciding whether to implement this measure, which of the following would be the BEST course of action to manage the organization’s risk?

116. A new employee is plugged into the network on a BYOD machine but cannot access the network.

Which of the following must be configured so the employee can connect to the network?

117. An enterprise is configuring an SSL client-based VPN for certificate authentication. The trusted root certificate from the CA is imported into the firewall, and the VPN configuration in the firewall is configured for certificate authentication. Signed certificates from the trusted CA are distributed to user devices. The CA certificate is set as trusted on the end-user devices, and the VPN client is configured on the end-user devices When the end users attempt to connect however, the firewall rejects the connection after a brief period.

Which of the following is the MOST likely reason the firewall rejects the connection?

118. A security assessor is working with an organization to review the policies and procedures associated with managing the organization’s virtual infrastructure. During a review of the virtual environment, the assessor determines the organization is using servers to provide more than one primary function, which violates a regulatory requirement. The assessor reviews hardening guides and determines policy allows for this configuration.

It would be MOST appropriate for the assessor to advise the organization to:

119. A company contracts a security consultant to perform a remote white-box penetration test. The company wants the consultant to focus on Internet-facing services without negatively impacting production services.

Which of the following is the consultant MOST likely to use to identify the company's attack surface? (Select TWO)

120. An organization is currently working with a client to migrate data between a legacy ERP system and a cloud-based ERP tool using a global PaaS provider. As part of the engagement, the organization is performing data deduplication and sanitization of client data to ensure compliance with regulatory requirements .

Which of the following is the MOST likely reason for the need to sanitize the client data?

121. A new database application was added to a company’s hosted VM environment. Firewall ACLs were modified to allow database users to access the server remotely. The company’s cloud security broker then identified abnormal from a database user on-site. Upon further investigation, the security team noticed the user ran code on a VM that provided access to the hypervisor directly and access to other sensitive data.

Which of the following should the security do to help mitigate future attacks within the VM environment? (Choose two.)

122. A developer needs to provide feedback on a peer’s work during the SDLC. While reviewing the code changes, the developers session ID tokens for a web application will be transmitted over an unsecure connection .

Which of the following code snippets should the developer recommend implement to correct the vulnerability?

A)





B)





C)





D)

123. Ann, a terminated employee, left personal photos on a company-issued laptop and no longer has access to them. Ann emails her previous manager and asks to get her personal photos back .

Which of the following BEST describes how the manager should respond?

124. A penetration test is being scoped for a set of web services with API endpoints. The APIs will be hosted on existing web application servers. Some of the new APIs will be available

to unauthenticated users, but some will only be available to authenticated users .

Which of the following tools or activities would the penetration tester MOST likely use or do during the engagement? (Select TWO.)

125. A systems administrator receives an advisory email that a recently discovered exploit is being used in another country and the financial institutions have ceased operations while they find a way to respond to the attack .

Which of the following BEST describes where the administrator should look to find information on the attack to determine if a response must be prepared for the systems? (Choose two.)

126. Which of the following is the GREATEST security concern with respect to BYOD?

127. A security incident responder discovers an attacker has gained access to a network and has overwritten key system files with backdoor software. The server was reimaged and patched offline.

Which of the following tools should be implemented to detect similar attacks?

128. A system administrator recently conducted a vulnerability scan of the internet. Subsequently, the organization was successfully attacked by an adversary .

Which of the following in the MOST likely explanation for why the organization network was compromised?

129. A network printer needs Internet access to function. Corporate policy states all devices allowed on the network must be authenticated .

Which of the following is the MOST secure method to allow the printer on the network without violating policy?

130. Several days after deploying an MDM for smartphone control, an organization began noticing anomalous behavior across the enterprise Security analysts observed the following:

• Unauthorized certificate issuance

• Access to mutually authenticated resources utilizing valid but unauthorized certificates

• Granted access to internal resources via the SSL VPN

To address the immediate problem security analysts revoked the erroneous certificates .

Which of the following describes the MOST likely root cause of the problem and offers a solution?

131. A Chief Information Security Officer (CISO) has created a survey that will be distributed to managers of mission-critical functions across the organization. The survey requires the managers to determine how long their respective units can operate in the event of an extended IT outage before the organization suffers monetary losses from the outage To which of the following is the survey question related? (Select TWO)

132. A manufacturing company's security engineer is concerned a remote actor may be able to access the ICS that is used to monitor the factory lines. The security engineer recently proposed some techniques to reduce the attack surface of the ICS to the Chief Information Security Officer (CISO) .

Which of the following would BEST track the reductions to show the CISO the engineer's plan is successful during each phase?

133. A project manager is working with a team that is tasked to develop software applications in a structured environment and host them in a vendor’s cloud-based infrastructure. The organization will maintain responsibility for the software but will not manage the underlying server applications .

Which of the following does the organization plan to leverage?

134. During a security event investigation, a junior analyst fails to create an image of a server’s hard drive before removing the drive and sending it to the forensics analyst. Later, the evidence from the analysis is not usable in the prosecution of the attackers due to the uncertainty of tampering .

Which of the following should the junior analyst have followed?

135. A Chief Information Security Officer (CISO) needs to create a policy set that meets international standards for data privacy and sharing .

Which of the following should the CISO read and understand before writing the policies?

136. A security is testing a server finds the following in the output of a vulnerability scan:





Which of the following will the security analyst most likely use NEXT to explore this further?

137. The Chief Information Security Officer (CISO) of a company that has highly sensitive corporate locations wants its security engineers to find a solution to growing concerns regarding mobile devices.

The CISO mandates the following requirements:

• The devices must be owned by the company for legal purposes.

• The device must be as fully functional as possible when off site.

• Corporate email must be maintained separately from personal email

• Employees must be able to install their own applications.

Which of the following will BEST meet the CISO's mandate? (Select TWO).

138. Following a complete outage of the electronic medical record system for more than 18 hours, the hospital’s Chief Executive Officer (CEO) has requested that the Chief Information Security Officer (CISO) perform an investigation into the possibility of a disgruntled employee causing the outage maliciously. To begin the investigation, the CISO pulls all event logs and device configurations from the time of the outage. The CISO immediately notices the configuration of a top-of-rack switch from one day prior to the outage does not match the configuration that was in place at the time of the outage. However, none of the event logs show who changed the switch configuration, and seven people have the ability to change it. Because of this, the investigation is inconclusive.

Which of the following processes should be implemented to ensure this information is available for future investigations?

139. A security administrator wants to implement two-factor authentication for network switches and routers. The solution should integrate with the company’s RADIUS server, which is used for authentication to the network infrastructure devices.

The security administrator implements the following:

✑ An HOTP service is installed on the RADIUS server.

✑ . The RADIUS server is configured to require the HOTP service for authentication.

The configuration is successfully tested using a software supplicant and enforced across all network devices. Network administrators report they are unable to log onto the network devices because they are not being prompted for the second factor.

Which of the following should be implemented to BEST resolve the issue?

140. A new corporate policy requires that all employees have access to corporate resources on personal mobile devices. The information assurance manager is concerned about the potential for inadvertent and malicious data disclosure if a device is lost, while users are concerned about corporate overreach .

Which of the following controls would address these concerns and should be reflected in the company's mobile device policy?

141. A company’s security policy states any remote connections must be validated using two forms of network-based authentication. It also states local administrative accounts should not be used for any remote access. PKI currently is not configured within the network. RSA tokens have been provided to all employees, as well as a mobile application that can be used for 2FA authentication. A new NGFW has been installed within the network to provide security for external connections, and the company has decided to use it for VPN connections as well .

Which of the following should be configured? (Choose two.)

142. Staff members are reporting an unusual number of device thefts associated with time out of the office. Thefts increased soon after the company deployed a new social networking app .

Which of the following should the Chief Information Security Officer (CISO) recommend implementing?

143. After a large organization has completed the acquisition of a smaller company, the smaller company must implement new host-based security controls to connect its employees’ devices to the network. Given that the network requires 802.1X EAP-PEAP to identify and authenticate devices, which of the following should the security administrator do to integrate the new employees’ devices into the network securely?

144. Following the most recent patch deployment, a security engineer receives reports that the ERP application is no longer accessible. The security engineer reviews the situation and determines a critical security patch that was applied to the ERP server is the cause. The patch is subsequently backed out.

Which of the following security controls would be BEST to implement to mitigate the threat caused by the missing patch?

145. An information security officer reviews a report and notices a steady increase in outbound network traffic over the past ten months. There is no clear explanation for the increase. The security officer interviews several business units and discovers an unsanctioned cloud storage provider was used to share marketing materials with potential customers .

Which of the following services would be BEST for the security officer to recommend to the company?

146. A security administrator is concerned about employees connecting their personal devices to the company network. Doing so is against company policy. The network does not have a NAC solution. The company uses a GPO that disables the firewall on all company-owned devices while they are connected to the internal network Additionally, all company-owned devices implement a standard naming convention that uses the device's serial number. The security administrator wants to identify active personal devices and write a custom script to disconnect them from the network.

Which of the following should the script use to BEST accomplish this task?

147. A security architect has been assigned to a new digital transformation program. The objectives are to provide better capabilities to customers and reduce costs.

The program has highlighted the following requirements:

✑ Long-lived sessions are required, as users do not log in very often.

✑ . The solution has multiple SPs, which include mobile and web applications.

✑ A centralized IdP is utilized for all customer digital channels.

✑ . The applications provide different functionality types such as forums and customer portals.

✑ . The user experience needs to be the same across both mobile and web-based applications.

Which of the following would BEST improve security while meeting these requirements?

148. A security administrator is confirming specific ports and IP addresses that are monitored by the IPS-IDS system as well as the firewall placement on the perimeter network between the company and a new business partner.

Which of the following business documents defines the parameters the security administrator must confirm?

149. A software company is releasing a new mobile application to a broad set of external customers. Because the software company is rapidly releasing new features, it has built in an over-the-air software update process that can automatically update the application at launch time .

Which of the following security controls should be recommended by the company’s security architect to protect the integrity of the update process? (Choose two.)

150. A project manager is working with a software development group to collect and evaluate user stories related to the organization’s internally designed CRM tool. After defining requirements, the project manager would like to validate the developer’s interpretation and understanding of the user’s request .

Which of the following would BEST support this objective?

151. A newly hired security analyst has joined an established SOC team. Not long after going through corporate orientation, a new attack method on web-based applications was publicly revealed. The security analyst immediately brings this new information to the team lead, but the team lead is not concerned about it.

Which of the following is the MOST likely reason for the team lead’s position?

152. The government is concerned with remote military missions being negatively being impacted by the use of technology that may fail to protect operational security.

To remediate this concern, a number of solutions have been implemented, including the following:

✑ End-to-end encryption of all inbound and outbound communication, including personal email and chat sessions that allow soldiers to securely communicate with families.

✑ Layer 7 inspection and TCP/UDP port restriction, including firewall rules to only allow TCP port 80 and 443 and approved applications

✑ A host-based whitelist of approved websites and applications that only allow mission-related tools and sites

✑ . The use of satellite communication to include multiple proxy servers to scramble the source IP address

Which of the following is of MOST concern in this scenario?

153. Following a merger, the number of remote sites for a company has doubled to 52. The company has decided to secure each remote site with an NGFW to provide web filtering, NIDS/NIPS, and network antivirus. The Chief Information Officer (CIO) has requested that the security engineer provide recommendations on sizing for the firewall with the requirements that it be easy to manage and provide capacity for growth.

The tables below provide information on a subset of remote sites and the firewall options:









Which of the following would be the BEST option to recommend to the CIO?

154. A legacy web application, which is being used by a hospital, cannot be upgraded for 12 months. A new vulnerability is found in the legacy application, and the networking team is tasked with mitigation. Middleware for mitigation will cost $100,000 per year .

Which of the following must be calculated to determine ROI? (Choose two.)

155. A security analyst is comparing two virtual servers that were bum from the same image and patched at the same regular intervals Server A is used to host a public-facing website, and Server B runs accounting software inside the firewalled accounting network.

The analyst runs the same command and obtains the following output from Server A and Server B. respectively:





Which of the following will the analyst most likely use NEXT?

156. An administrator wants to ensure hard drives cannot be removed from hosts and men installed into and read by unauthorized hosts.

Which of the following techniques would BEST support this?

157. A government entity is developing requirements for an RFP to acquire a biometric authentication system.

When developing these requirements, which of the following considerations is MOST critical to the verification and validation of the SRTM?

158. The email administrator must reduce the number of phishing emails by utilizing more appropriate security controls.

The following configurations already are in place

• Keyword Mocking based on word lists

• URL rewriting and protection

• Stopping executable files from messages

Which of the following is the BEST configuration change for the administrator to make?

159. An organization wants to allow its employees to receive corporate email on their own smartphones.

A security analyst is reviewing the following information contained within the file system of an employee’s smartphone:

FamilyPix.jpg

Taxreturn.tax

paystub.pdf

employeesinfo.xls

SoccerSchedule.doc

RecruitmentPlan.xls

Based on the above findings, which of the following should the organization implement to prevent further exposure? (Select two).

160. A security technician is incorporating the following requirements in an RFP for a new SIEM:

✑ New security notifications must be dynamically implemented by the SIEM engine

✑ . The SIEM must be able to identify traffic baseline anomalies

✑ Anonymous attack data from all customers must augment attack detection and risk scoring

Based on the above requirements, which of the following should the SIEM support? (Choose two.)

161. CORRECT TEXT

You are a security analyst tasked with interpreting an Nmap scan output from Company A's privileged network.

The company's hardening guidelines indicate the following:

• There should be one primary server or service per device.

• Only default ports should be used.

• Non-secure protocols should be disabled.

INSTRUCTIONS

Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed.

For each device found, add a device entry to the Devices Discovered list, with the following information:

• The IP address of the device

• The primary server or service of the device

• The protocol(s) that should be disabled based on the hardening guidelines

162. The SOC has noticed an unusual volume of traffic coming from an open WiFi guest network that appears correlated with a broader network slowdown.

The network team is unavailable to capture traffic but logs from network services are available

• No users have authenticated recently through the guest network's captive portal

• DDoS mitigation systems are not alerting

• DNS resolver logs show some very long domain names

Which of the following is the BEST step for a security analyst to take next?

163. A SaaS-based email service provider often receives reports from legitimate customers that their IP netblocks are on blacklists and they cannot send email. The SaaS has confirmed that affected customers typically have IP addresses within broader network ranges and some abusive customers within the same IP ranges may have performed spam campaigns .

Which of the following actions should the SaaS provider perform to minimize legitimate customer impact?

164. The Chief Information Officer (CIO) wants to increase security and accessibility among the organization’s cloud SaaS applications. The applications are configured to use passwords, and two-factor authentication is not provided natively .

Which of the following would BEST address the CIO’s concerns?

165. Which of the following system would be at the GREATEST risk of compromise if found to have an open vulnerability associated with perfect ... secrecy?

166. A security engineer is working to secure an organization’s VMs. While reviewing the workflow for creating VMs on demand, the engineer raises a concern about the integrity of the secure boot process of the VM guest.

Which of the following would BEST address this concern?

167. During a criminal investigation, the prosecutor submitted the original hard drive from the suspect’s computer as evidence. The defense objected during the trial proceedings, and the evidence was rejected .

Which of the following practices should the prosecutor’s forensics team have used to ensure the suspect’s data would be admissible as evidence? (Select TWO.)

168. An organization has employed the services of an auditing firm to perform a gap assessment in preparation for an upcoming audit. As part of the gap assessment, the auditor supporting the assessment recommends the organization engage with other industry partners to share information about emerging attacks to organizations in the industry in which the organization functions.

Which of the following types of information could be drawn from such participation?

169. An organization is considering the use of a thin client architecture as it moves to a cloud-hosted environment. A security analyst is asked to provide thoughts on the security advantages of using thin clients and virtual workstations .

Which of the following are security advantages of the use of this combination of thin clients and virtual workstations?

170. A security architect is implementing security measures in response to an external audit that found vulnerabilities in the corporate collaboration tool suite. The report identified the lack of any mechanism to provide confidentiality for electronic correspondence between users and between users and group mailboxes .

Which of the following controls would BEST mitigate the identified vulnerability?

171. Following a recent and very large corporate merger, the number of log files an SOC needs to review has approximately tripled. The Chief Information Security Officer (CISO) has not been allowed to hire any more staff for the SOC, but is looking for other ways to automate the log review process so the SOC receives less noise .

Which of the following would BEST reduce log noise for the SOC?

172. A legal services company wants to ensure emails to clients maintain integrity in transit.

Which of the following would BEST meet this requirement? (Select TWO)

173. A pharmacy gives its clients online access to their records and the ability to review bills and make payments. A new SSL vulnerability on a special platform was discovered, allowing an attacker to capture the data between the end user and the web server providing these services. After invest the new vulnerability, it was determined that the web services providing are being impacted by this new threat .

Which of the following data types a MOST likely at risk of exposure based on this new threat? (Select TWO)

174. Two new technical SMB security settings have been enforced and have also become policies that increase secure communications.

Network Client: Digitally sign communication

Network Server: Digitally sign communication

A storage administrator in a remote location with a legacy storage array, which contains time-sensitive data, reports employees can no longer connect to their department shares .

Which of the following mitigation strategies should an information security manager recommend to the data owner?

175. A server (10.0.0.2) on the corporate network is experiencing a DoS from a number of marketing desktops that have been compromised and are connected to a separate network segment.

The security engineer implements the following configuration on the management router:





Which of the following is the engineer implementing?

176. A software development team has spent the last 18 months developing a new web-based front-end that will allow clients to check the status of their orders as they proceed through manufacturing. The marketing team schedules a launch party to present the new application to the client base in two weeks. Before the launch, the security team discovers numerous flaws that may introduce dangerous vulnerabilities, allowing direct access to a database used by manufacturing. The development team did not plan to remediate these vulnerabilities during development.

Which of the following SDLC best practices should the development team have followed?

177. A security analyst receives an email from a peer that includes a sample of code from a piece of malware found in an application running in the organization’s staging environment. During the incident response process, it is determined the code was introduced into the environment as a result of a compromised laptop being used to harvest credentials and access the organization’s code repository. While the laptop itself was not used to access the code repository, an attacker was able to leverage the harvested credentials from another system in the development environment to bypass the ACLs limiting access to the repositories .

Which of the following controls MOST likely would have interrupted the kill chain in this attack?

178. A security engineer is troubleshooting an issue in which an employee is getting an IP address in the range on the wired network. The engineer plus another PC into the same port, and that PC gets an IP address in the correct range. The engineer then puts the employee’ PC on the wireless network and finds the PC still not get an IP address in the proper range. The PC is up to date on all software and antivirus definitions, and the IP address is not an APIPA address .

Which of the following is MOST likely the problem?

179. A company is implementing a new secure identity application, given the following requirements

• The cryptographic secrets used in the application must never be exposed to users or the OS

• The application must work on mobile devices.

• The application must work with the company's badge reader system

Which of the following mobile device specifications are required for this design? (Select TWO).

180. A company’s claims processed department has a mobile workforce that receives a large number of email submissions from personal email addresses. An employees recently received an email that approved to be claim form, but it installed malicious software on the employee’s laptop when was opened.

181. A Chief Information Security Officer (CISO) is running a test to evaluate the security of the corporate network and attached devices .

Which of the following components should be executed by an outside vendor?

182. A video-game developer has received reports of players who are cheating. All game players each have five capabilities that are ranked on a scale of 1 to 10 points, with 10 total points available for balance. Players can move these points between capabilities at any time.

The programming logic is as follows:

• A player asks to move points from one capability to another

• The source capability must have enough points to allow the move

• The destination capability must not exceed 10 after the move

• The move from source capability to destination capability is then completed

The time stamps of the game logs show each step of the transfer process takes about 900ms However, the time stamps of the cheating players show capability transfers at the exact same time. The cheating players have 10 points in multiple capabilities .

Which of the following is MOST likely being exploited to allow these capability transfers?

183. A security administrator wants to allow external organizations to cryptographically validate the company’s domain name in email messages sent by employees .

Which of the following should the security administrator implement?

184. A security engineer is attempting to increase the randomness of numbers used in key generation in a system. The goal of the effort is to strengthen the keys against predictive analysis attacks.

Which of the following is the BEST solution?

185. An organization wants to arm its cybersecurity defensive suite automatically with intelligence on zero-day threats shortly after they emerge. Acquiring tools and services that support which of the following data standards would BEST enable the organization to meet this objective?

186. Designing a system in which only information that is essential for a particular job task is allowed to be viewed can be accomplished successfully by using:

187. A penetration testing manager is contributing to an RFP for the purchase of a new platform.

The manager has provided the following requirements:

✑ Must be able to MITM web-based protocols

✑ Must be able to find common misconfigurations and security holes

Which of the following types of testing should be included in the testing platform? (Choose two.)

188. A recent overview of the network’s security and storage applications reveals a large amount of data that needs to be isolated for security reasons.

Below are the critical applications and devices configured on the network:

✑ Firewall

✑ Core switches

✑ RM server

✑ Virtual environment

✑ NAC solution

The security manager also wants data from all critical applications to be aggregated to correlate events from multiple sources .

Which of the following must be configured in certain applications to help ensure data aggregation and data isolation are implemented on the critical applications and devices? (Select TWO).

189. A hospital uses a legacy electronic medical record system that requires multicast for traffic between the application servers and databases on virtual hosts that support segments of the application. Following a switch upgrade, the electronic medical record is unavailable despite physical connectivity between the hypervisor and the storage being in place. The network team must enable multicast traffic to restore access to the electronic medical record. The ISM states that the network team must reduce the footprint of multicast traffic on the network.





Using the above information, on which VLANs should multicast be enabled?

190. An internal application has been developed to increase the efficiency of an operational process of a global manufacturer. New code was implemented to fix a security bug, but it has caused operations to halt. The executive team has decided fixing the security bug is less important than continuing operations.

Which of the following would BEST support immediate rollback of the failed fix? (Choose two.)

191. Following the merger of two large companies the newly combined security team is overwhelmed by the volume of logs flowing from the IT systems. The company's data retention schedule complicates the issue by requiring detailed logs to be collected and available for months .

Which of the following designs BEST meets the company's security and retention requirement?

192. A core router was manipulated by a credentialed bypass to send all network traffic through a secondary router under the control of an unauthorized user connected to the network by WiFi.

Which of the following would BEST reduce the risk of this attack type occurring?

193. An organization is struggling to differentiate threats from normal traffic and access to systems. A security engineer has been asked to recommend a system that will aggregate data and provide metrics that will assist in identifying malicious actors or other anomalous activity throughout the environment .

Which of the following solutions should the engineer recommend?

194. A networking administrator was recently promoted to security administrator in an organization that handles highly sensitive data. The Chief Information Security Officer (CISO) has just asked for all IT security personnel to review a zero-day vulnerability and exploit for specific application servers to help mitigate the organization’s exposure to that risk .

Which of the following should the new security administrator review to gain more information? (Choose three.)

195. CORRECT TEXT

Compliance with company policy requires a quarterly review of firewall rules. You are asked to conduct a review on the internal firewall sitting between several internal networks. The intent of this firewall is to make traffic more secure.

Given the following information perform the tasks listed below:

Untrusted zone: 0.0.0.0/0

User zone: USR 10.1.1.0/24

User zone: USR2 10.1.2.0/24

DB zone: 10.1.4.0/24

Web application zone: 10.1.5.0/24

Management zone: 10.1.10.0/24

Web server: 10.1.5.50

MS-SQL server: 10.1.4.70

MGMT platform: 10.1.10.250

Instructions: To perform the necessary tasks, please modify the DST port, SRC zone, Protocol, Action, and/or Rule Order columns. Type ANY to include all ports. Firewall ACLs are read from the top down. Once you have met the simulation requirements, click Save. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.





Task 1) A rule was added to prevent the management platform from accessing the internet.

This rule is not working. Identify the rule and correct this issue.

Task 2). The firewall must be configured so that the SQL server can only receive requests from the web server.

Task 3). The web server must be able to receive unencrypted requests from hosts inside and outside the corporate network.

Task 4) Ensure the final rule is an explicit deny.

Task 5) Currently the user zone can access internet websites over an unencrypted protocol. Modify a rule so that user access to websites is over secure protocols only.

Instructions: To perform the necessary tasks, please modify the DST port, SRC zone, Protocol, Action, and/or Rule Order columns. Type ANY to include all ports. Firewall ACLs are read from the top down. Once you have met the simulation requirements, click Save. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

196. A security analyst is reviewing an endpoint that was found to have a rookit installed. The rootkit survived multiple attempts to clean the endpoints, as well as an attempt to reinstall the QS. The security analyst needs to implement a method to prevent other endpoint from having similar issues .

Which of the following would BEST accomplish this objective?

197. A laptop is recovered a few days after it was stolen.

Which of the following should be verified during incident response activities to determine the possible impact of the incident?

198. An internal penetration tester was assessing a recruiting page for potential issues before it was pushed to the production website. The penetration tester discovers an issue that must be corrected before the page goes live. The web host administrator collects the log files below and gives them to the development team so improvements can be made to the security design of the website.





Which of the following types of attack vector did the penetration tester use?

199. A bank is initiating the process of acquiring another smaller bank.

Before negotiations happen between the organizations, which of the following business documents would be used as the FIRST step in the process?

200. A school contracts with a vendor to devise a solution that will enable the school library to lend out tablet computers to students while on site. The tablets must adhere to string security and privacy practices.

The school’s key requirements are to:

✑ Maintain privacy of students in case of loss

✑ Have a theft detection control in place

✑ Be compliant with defined disability requirements

✑ Have a four-hour minimum battery life

Which of the following should be configured to BEST meet the requirements? (Choose two.)

201. A security analyst has requested network engineers integrate sFlow into the SOC’s overall monitoring picture.

For this to be a useful addition to the monitoring capabilities, which of the following must be considered by the engineering team?

202. An organization is evaluating options related to moving organizational assets to a cloud-based environment using an IaaS provider. One engineer has suggested connecting a second cloud environment within the organization’s existing facilities to capitalize on available datacenter space and resources. Other project team members are concerned about such a commitment of organizational assets, and ask the Chief Security Officer (CSO) for input. The CSO explains that the project team should work with the engineer to evaluate the risks associated with using the datacenter to implement:

203. Click on the exhibit buttons to view the four messages.





















A security architect is working with a project team to deliver an important service that stores and processes customer banking details. The project, internally known as ProjectX, is due to launch its first set of features publicly within a week, but the team has not been able to implement encryption-at-rest of the customer records. The security architect is drafting an escalation email to senior leadership.

Which of the following BEST conveys the business impact for senior leadership?

204. A Chief Information Securiy Officer (CISO) is reviewing technical documentation from various regional offices and notices some key differences between these groups. The CISO has not discovered any governance documentation. The CISO creates the following chart to visualize the differences among the networking used.





Which of the following would be the CISO’s MOST immediate concern?

205. As part of a systems modernization program, the use of a weak encryption algorithm is identified m a wet se-vices API. The client using the API is unable to upgrade the system on its end which would support the use of a secure algorithm set As a temporary workaround the client provides its IP space and the network administrator Limits access to the API via an ACL to only the IP space held by the client .

Which of the following is the use of the ACL in this situation an example of?

206. An organization is in the process of integrating its operational technology and information technology areas. As part of the integration, some of the cultural aspects it would like to see include more efficient use of resources during change windows, better protection of critical infrastructure, and the ability to respond to incidents.

The following observations have been identified:

✑ The ICS supplier has specified that any software installed will result in lack of support.

✑ There is no documented trust boundary defined between the SCADA and corporate networks.

✑ Operational technology staff have to manage the SCADA equipment via the engineering workstation.

✑ There is a lack of understanding of what is within the SCADA network.

Which of the following capabilities would BEST improve the security position?

207. A company that uses AD is migrating services from LDAP to secure LDAP. During the pilot phase, services are not connecting properly to secure LDAP. Block is an except of output from the troubleshooting session:





Which of the following BEST explains why secure LDAP is not working? (Select TWO.)

208. An analyst is investigating behavior on a corporate-owned, corporate-managed mobile device with application whitelisting enabled, based on a name string. The employee to whom the device is assigned reports the approved email client is displaying warning messages that can launch browser windows and is adding unrecognized email addresses to the “compose” window.

Which of the following would provide the analyst the BEST chance of understanding and characterizing the malicious behavior?

209. A software development firm wants to validate the use of standard libraries as part of the software development process Each developer performs unit testing prior to committing changes to the code repository .

Which of the following activities would be BEST to perform after a commit but before the creation of a branch?

210. An engineer is assisting with the design of a new virtualized environment that will house critical company services and reduce the datacenter’s physical footprint. The company has expressed concern about the integrity of operating systems and wants to ensure a vulnerability exploited in one datacenter segment would not lead to the compromise of all others.

Which of the following design objectives should the engineer complete to BEST mitigate the company’s concerns? (Choose two.)

211. While conducting a BIA for a proposed acquisition, the IT integration team found that both companies outsource CRM services to competing and incompatible third-party cloud services. The decision has been made to bring the CRM service in-house, and the IT team has chosen a future solution. With which of the following should the Chief Information Security Officer (CISO) be MOST concerned? (Choose two.)

212. A company recently implemented a variety of security services to detect various types of traffic that pose a threat to the company.

The following services were enabled within the network:

• Scan of specific subsets for vulnerabilities

• Categorizing and logging of website traffic

• Enabling specific ACLs based on application traffic

• Sending suspicious files to a third-party site for validation

A report was sent to the security team that identified multiple incidents of users sharing large amounts of data from an on-premise server to a public site. A small percentage of that data also contained malware and spyware

Which of the following services MOST likely identified the behavior and sent the report?

213. An organization is facing budget constraints. The Chief Technology Officer (CTO) wants to add a new marketing platform but the organization does not have the resources to obtain separate servers to run the new platform. The CTO recommends running the new marketing platform on a virtualized video-conferencing server because video conferencing is rarely used. The Chief Information Security Officer (CISO) denies this request.

Which of the following BEST explains the reason why the CISO has not approved the request?

214. An organization is preparing to develop a business continuity plan. The organization is required to meet regulatory requirements relating to confidentiality and availability, which are well-defined. Management has expressed concern following initial meetings that the organization is not fully aware of the requirements associated with the regulations.

Which of the following would be MOST appropriate for the project manager to solicit additional resources for during this phase of the project?

215. A remote user reports the inability to authenticate to the VPN concentrator.

During troubleshooting, a security administrate captures an attempted authentication and discovers the following being presented by the user's VPN client:





Which of the following BEST describes the reason the user is unable to connect to the VPN service?

216. A security architect is designing a system to satisfy user demand for reduced transaction time, increased security and message integrity, and improved cryptographic security. The resultant system will be used in an environment with a broad user base where many asynchronous transactions occur every minute and must be publicly verifiable.

Which of the following solutions BEST meets all of the architect’s objectives?

217. An organization is implementing a virtualized thin-client solution for normal user computing and access. During a review of the architecture, concerns were raised that an attacker could gain access to multiple user environments by simply gaining a foothold on a single one with malware .

Which of the following reasons BEST explains this?

218. A technician uses an old SSL server due to budget constraints and discovers performance degrades dramatically after enabling PFS. The technician cannot determine why performance degraded so dramatically A newer version of the SSL server does not suffer the same performance degradation. Performance rather than security is the main priority for the technician.

The system specifications and configuration of each system are listed below:





Which of the following is MOST likely the cause of the degradation in performance and should be changed?

219. The Chief Information Security Officer (CISO) for an organization wants to develop custom IDS rulesets faster, prior to new rules being released by IDS vendors .

Which of the following BEST meets this objective?

220. A company in the financial sector receives a substantial number of customer transaction requests via email. While doing a root-cause analysis conceding a security breach, the CIRT correlates an unusual spike in port 80 traffic from the IP address of a desktop used by a customer relations employee who has access to several of the compromised accounts. Subsequent antivirus scans of the device do not return an findings, but the CIRT finds undocumented services running on the device .

Which of the following controls would reduce the discovery time for similar in the future?