CompTIA CASP+ CAS-003 Exam Updated Questions

1. Access to the corporate applications

Which of the following solution components should be deployed to BEST meet the requirements? (Select three.)

2. A company’s Chief Operating Officer (COO) is concerned about the potential for competitors to infer proprietary information gathered from employees’ social media accounts.

Which of the following methods should the company use to gauge its social media threat level without targeting individual employees?

3. A security administrator receives reports that several workstations are unable to access resources within one network segment. A packet capture shows the segment is flooded with ICMPv6 traffic from the source fe80::21ae;4571:42ab:1fdd and for the destination ff02::1 .

Which of the following should the security administrator integrate into the network to help prevent this from occurring?

4. The results of an external penetration test for a software development company show a small number of applications account for the largest number of findings.

While analyzing the content and purpose of the applications, the following matrix is created.





The findings are then categorized according to the following chart:





Which of the following would BEST reduce the amount of immediate risk incurred by the organization from a compliance and legal standpoint? (Select TWO)

5. Due to a recent breach, the Chief Executive Officer (CEO) has requested the following activities be conducted during incident response planning:

✑ Involve business owners and stakeholders

✑ Create an applicable scenario

✑ Conduct a biannual verbal review of the incident response plan

✑ Report on the lessons learned and gaps identified

Which of the following exercises has the CEO requested?

6. An organization is moving internal core data-processing functions related to customer data to a global public cloud provider that uses aggregated services from other partner organizations .

Which of the following compliance issues will MOST likely be introduced as a result of the migration?

7. A manufacturing company recently recovered from an attack on its ICS devices. It has since reduced the attack surface by isolating the affected components. The company now wants to implement detection capabilities. It is considering a system that is based on machine learning .

Which of the following features would BEST describe the driver to adopt such nascent technology over mainstream commercial IDSs?

8. A company wants to confirm sufficient executable space protection is in place for scenarios in which malware may be attempting buffer overflow attacks .

Which of the following should the security engineer check?

9. Following a merger, the number of remote sites for a company has doubled to 52. The company has decided to secure each remote site with an NGFW to provide web filtering, NIDS/NIPS, and network antivirus. The Chief Information Officer (CIO) has requested that the security engineer provide recommendations on sizing for the firewall with the requirements that it be easy to manage and provide capacity for growth.

The tables below provide information on a subset of remote sites and the firewall options:









Which of the following would be the BEST option to recommend to the CIO?

10. A manufacturing company's security engineer is concerned a remote actor may be able to access the ICS that is used to monitor the factory lines. The security engineer recently proposed some techniques to reduce the attack surface of the ICS to the Chief Information Security Officer (CISO) .

Which of the following would BEST track the reductions to show the CISO the engineer's plan is successful during each phase?

11. An internal penetration tester was assessing a recruiting page for potential issues before it was pushed to the production website. The penetration tester discovers an issue that must be corrected before the page goes live. The web host administrator collects the log files below and gives them to the development team so improvements can be made to the security design of the website.





Which of the following types of attack vector did the penetration tester use?

12. A security analyst has been assigned incident response duties and must instigate the response on a Windows device that appears to be compromised .

Which of the following commands should be executed on the client FIRST?

A)





B)





C)





D)

13. A Chief Information Security Officer (CISO) is working with a consultant to perform a gap assessment prior to an upcoming audit. It is determined during the assessment that the organization lacks controls to effectively assess regulatory compliance by third-party service providers .

Which of the following should be revised to address this gap?

14. A security analyst sees some suspicious entries in a log file from a web server website, which has a form that allows customers to leave feedback on the company’s products. The analyst believes a malicious actor is scanning the web form. To know which security controls to put in place, the analyst first needs to determine the type of activity occurring to design a control.

Given the log below:





Which of the following is the MOST likely type of activity occurring?

15. An administrator wants to ensure hard drives cannot be removed from hosts and men installed into and read by unauthorized hosts.

Which of the following techniques would BEST support this?

16. A company provides guest WiFi access to the internet and physically separates the guest network from the company’s internal WIFI. Due to a recent incident in which an attacker gained access to the compay’s intend WIFI, the company plans to configure WPA2 Enterprise in an EAP- TLS configuration .

Which of the following must be installed on authorized hosts for this new configuration to work properly?

17. A health company has reached the physical and computing capabilities in its datacenter, but the computing demand continues to increase. The infrastructure is fully virtualized and runs custom and commercial healthcare application that process sensitive health and payment information .

Which of the following should the company implement to ensure it can meet the computing demand while complying with healthcare standard for virtualization and cloud computing?

18. A security administrator is opening connectivity on a firewall between Organization A and Organization B Organization B just acquired Organization A .

Which of the following risk mitigation strategies should the administrator implement to reduce the risk involved with this change?

19. A company has made it a spending priority to implement security architectures that will be resilient during an attack. Recent incidents have involved attackers leveraging latent vulnerabilities in cryptographic implementations and VPN concentrators to be able to compromise sensitive information. Patches have been slowly released for these emergent vulnerabilities, leaving weeks to months of exposed and vulnerable attack surface .

Which of the following approaches would be BEST to increase enterprise resilience during similar future attacks?

20. Following the most recent patch deployment, a security engineer receives reports that the ERP application is no longer accessible. The security engineer reviews the situation and determines a critical security patch that was applied to the ERP server is the cause. The patch is subsequently backed out.

Which of the following security controls would be BEST to implement to mitigate the threat caused by the missing patch?

21. An organization is concerned that its hosted web servers are not running the most updated version of

software .

Which of the following would work BEST to help identify potential vulnerabilities?

22. The Chief Executive Officer (CEO) of a company has considered implementing a cost-saving measure that might result in new risk to the company.

When deciding whether to implement this measure, which of the following would be the BEST course of action to manage the organization’s risk?

23. An organization's mobile device inventory recently provided notification that a zero-day vulnerability was identified in the code used to control the baseband of the devices. The device manufacturer is expediting a patch, but the rollout will take several months Additionally several mobile users recently returned from an overseas trip and report their phones now contain unknown applications, slowing device performance Users have been unable to uninstall these applications, which persist after wiping the devices.

Which of the following MOST likely occurred and provides mitigation until the patches are released?

24. Ann, a security manager, is reviewing a threat feed that provides information about attacks that allow a malicious user to gain access to private contact lists. Ann receives a notification that the vulnerability can be exploited within her environment.

Given this information, Ann can anticipate an increase in:

25. A cybersecurity analyst is hired to review the security the posture of a company. The cybersecurity analyst notice a very high network bandwidth consumption due to SYN floods from a small number of IP addresses .

Which of the following would be the BEST action to take to support incident response?

26. An organization has recently deployed an EDR solution across its laptops, desktops, and server infrastructure. The organization’s server infrastructure is deployed in an IaaS environment. A database within the non-production environment has been misconfigured with a routable IP and is communicating with a command and control server.

Which of the following procedures should the security responder apply to the situation? (Choose two.)

27. A medical device company is implementing a new COTS antivirus solution in its manufacturing plant. All validated machines and instruments must be retested for interoperability with the new software .

Which of the following would BEST ensure the software and instruments are working as designed?

28. A security manager wants to implement a policy that will management with the ability to monitor employees’ activities with minimum impact to productivity .

Which of the following policies Is BEST suited for this scenario?

29. A security engineer is assessing the controls that are in place to secure the corporate-Internet-facing DNS server. The engineer notices that security ACLs exist but are not being used properly. The DNS server should respond to any source but only provide information about domains it has authority over. Additionally, the DNS administrator have identified some problematic IP addresses that should not be able to make DNS requests.

Given the ACLs below:





Which of the following should the security administrator configure to meet the DNS security needs?

A)





B)





C)





D)

30. Which of the following attacks can be used to exploit a vulnerability that was created by untrained users?

31. While traveling to another state, the Chief Financial (CFO) forgot to submit payroll for the company. The CFO quickly gained to the corporate through the high-speed wireless network provided by the hotel and completed the desk. Upon returning from the business trip, the CFO was told no one received their weekly pay due to a malware on attack on the system .

Which of the following is the MOST likely of the security breach?

32. An application developer is including third-party background security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is released to the public, report come In that a previously vulnerability has returned .

Which of the following should the developer integrate into the process to BEST prevent this type of behavior?

33. The OS on several servers crashed around the same time for an unknown reason. The servers were restored to working condition, and all file integrity was verified .

Which of the following should the incident response team perform to understand the crash and prevent it in the future?

34. Effectiveness and performance of the security team appears to be degrading.

35. An architect was recently hired by a power utility to increase the security posture of the company’s power generation and distribution sites. Upon review, the architect identifies legacy hardware with highly vulnerable and unsupported software driving critical operations. These systems must exchange data with each other, be highly synchronized, and pull from the Internet time sources .

Which of the following architectural decisions would BEST reduce the likelihood of a successful attack without harming operational capability? (Choose two.)

36. A penetration tester is given an assignment lo gain physical access to a secure facility with perimeter cameras. The secure facility does not accept visitors and entry is available only through a door protected by an RFID key and a guard stationed inside the door.

Which of the following would be BEST for the penetration tester to attempt?

37. A security engineer is working to secure an organization’s VMs. While reviewing the workflow for creating VMs on demand, the engineer raises a concern about the integrity of the secure boot process of the VM guest.

Which of the following would BEST address this concern?

38. DRAG DROP

Drag and drop the cloud deployment model to the associated use-case scenario. Options may be used only once or not at all.

39. A product owner is reviewing the output of a web-application penetration test and has identified an application that is presenting sensitive information in cleartext on a page .

Which of the following code snippets would be BEST to use to remediate the vulnerability?

40. An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes. The machine is running a very recent release of the Linux OS.

Which of the following technical approaches would be the MOST feasible way to accomplish this capture?

41. A security analyst is classifying data based on input from data owners and other stakeholders.

The analyst has identified three data types:

✑ Financially sensitive data

✑ Project data

✑ Sensitive project data

The analyst proposes that the data be protected in two major groups, with further access control separating the financially sensitive data from the sensitive project data. The normal project data will be stored in a separate, less secure location. Some stakeholders are concerned about the recommended approach and insist that commingling data from different sensitive projects would leave them vulnerable to industrial espionage.

Which of the following is the BEST course of action for the analyst to recommend?

42. A technician is reviewing the following log:





Which of the following tools should the organization implement to reduce the highest risk identified in this log?

43. Which of the following is MOST likely to be included in a security services SLA with a third-party vendor?

44. A server (10.0.0.2) on the corporate network is experiencing a DoS from a number of marketing desktops that have been compromised and are connected to a separate network segment.

The security engineer implements the following configuration on the management router:





Which of the following is the engineer implementing?

45. A user asks a security practitioner for recommendations on securing a home network. The user recently purchased a connected home assistant and multiple IoT devices in an effort to automate the home. Some of the IoT devices are wearables, and other are installed in the user’s automobiles. The current home network is configured as a single flat network behind an ISP-supplied router. The router has a single IP address, and the router performs NAT on incoming traffic to route it to individual devices.

Which of the following security controls would address the user’s privacy concerns and provide the BEST level of security for the home network?

46. An organization is attempting to harden its web servers and reduce the information that might be disclosed by potential attackers. A security anal... reviewing vulnerability scan result from a recent web server scan.

Portions of the scan results are shown below:

Finding# 5144322

First time detected 10 nov 2015 09:00 GMT_0600

Last time detected 10 nov 2015 09:00 GMT_0600

CVSS base: 5

Access path: http://myorg.com/mailinglist.htm

Request: GET http://mailinglist.aspx?content=volunteer

Response: C:DocmentsMarySmithmalinglist.pdf

Which of the following lines indicates information disclosure about the host that needs to be remediated?

47. An engineer is evaluating the control profile to assign to a system containing PII, financial, and proprietary data.





Based on the data classification table above, which of the following BEST describes the overall classification?

48. The Chief Financial Officer (CFO) of a major hospital system has received a ransom letter that demands a large sum of cryptocurrency be transferred to an anonymous account. If the transfer does not take place within ten hours, the letter states that patient information will be released on the dark web. A partial listing of recent patients is included in the letter. This is the first indication that a breach took place .

Which of the following steps should be done FIRST?

49. A penetration tester is trying to gain access to a remote system. The tester is able to see the secure login page and knows one user account and email address, but has not yet discovered a password.

Which of the following would be the EASIEST method of obtaining a password for the known account?

50. An attacker has been compromising banking institution targets across a regional area. The Chief Information Security Officer (CISO) at a local bank wants to detect and prevent an attack before the bank becomes a victim .

Which of the following actions should the CISO take?

51. Which of the following attacks can be mitigated by proper data retention policies?

52. The Chief Financial Officer (CFO) of an organization wants the IT department to add the CFO's account to the domain administrator group. The IT department thinks this is risky and wants support from the security manager before proceeding .

Which of the following BEST supports the argument against providing the CFO with domain administrator access?

53. A Chief information Security Officer (CISO) is developing corrective-action plans based on the following from a vulnerability scan of internal hosts:





Which of the following MOST appropriate corrective action to document for this finding?

54. A company is developing requirements for a customized OS build that will be used in an embedded environment. The company procured hardware that is capable of reducing the likelihood of successful buffer overruns while executables are processing .

Which of the following capabilities must be included for the OS to take advantage of this critical hardware-based countermeasure?

55. A security analyst is comparing two virtual servers that were bum from the same image and patched at the same regular intervals Server A is used to host a public-facing website, and Server B runs accounting software inside the firewalled accounting network.

The analyst runs the same command and obtains the following output from Server A and Server B. respectively:





Which of the following will the analyst most likely use NEXT?

56. Designing a system in which only information that is essential for a particular job task is allowed to be viewed can be accomplished successfully by using:

57. An application has been through a peer review and regression testing and is prepared for release. A security engineer is asked to analyze an application binary to look for potential vulnerabilities prior to wide release. After thoroughly analyzing the application, the engineer informs the developer it should include additional input sanitation in the application to prevent overflows .

Which of the following tools did the security engineer MOST likely use to determine this recommendation?

58. CORRECT TEXT

Compliance with company policy requires a quarterly review of firewall rules. You are asked to conduct a review on the internal firewall sitting between several internal networks. The intent of this firewall is to make traffic more secure.

Given the following information perform the tasks listed below:

Untrusted zone: 0.0.0.0/0

User zone: USR 10.1.1.0/24

User zone: USR2 10.1.2.0/24

DB zone: 10.1.4.0/24

Web application zone: 10.1.5.0/24

Management zone: 10.1.10.0/24

Web server: 10.1.5.50

MS-SQL server: 10.1.4.70

MGMT platform: 10.1.10.250

Instructions: To perform the necessary tasks, please modify the DST port, SRC zone, Protocol, Action, and/or Rule Order columns. Type ANY to include all ports. Firewall ACLs are read from the top down. Once you have met the simulation requirements, click Save. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.





Task 1) A rule was added to prevent the management platform from accessing the internet.

This rule is not working. Identify the rule and correct this issue.

Task 2). The firewall must be configured so that the SQL server can only receive requests from the web server.

Task 3). The web server must be able to receive unencrypted requests from hosts inside and outside the corporate network.

Task 4) Ensure the final rule is an explicit deny.

Task 5) Currently the user zone can access internet websites over an unencrypted protocol. Modify a rule so that user access to websites is over secure protocols only.

Instructions: To perform the necessary tasks, please modify the DST port, SRC zone, Protocol, Action, and/or Rule Order columns. Type ANY to include all ports. Firewall ACLs are read from the top down. Once you have met the simulation requirements, click Save. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

59. A security administrator is updating a company’s SCADA authentication system with a new application.

To ensure interoperability between the legacy system and the new application, which of the following stakeholders should be involved in the configuration process before deployment? (Choose two.)

60. During the deployment of a new system, the implementation team determines that APIs used to integrate the new system with a legacy system are not functioning properly. Further investigation shows there is a misconfigured encryption algorithm used to secure data transfers between systems .

Which of the following should the project manager use to determine the source of the defined algorithm in use?

61. A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application. The security administrator isolated the switch on a separate VLAN and set up a patching routine .

Which of the following steps should also be taken to harden the smart switch?

62. Several days after deploying an MDM for smartphone control, an organization began noticing anomalous behavior across the enterprise Security analysts observed the following:

• Unauthorized certificate issuance

• Access to mutually authenticated resources utilizing valid but unauthorized certificates

• Granted access to internal resources via the SSL VPN

To address the immediate problem security analysts revoked the erroneous certificates .

Which of the following describes the MOST likely root cause of the problem and offers a solution?

63. A security analyst, who is working in a Windows environment, has noticed a significant amount of IPv6 traffic originating from a client, even though IPv6 is not currently in use. The client is a stand-alone device, not connected to the AD that manages a series of SCADA devices used for manufacturing .

Which of the following is the appropriate command to disable the client’s IPv6 stack?

A)





B)





C)





D)

64. Company.org has requested a black-box security assessment be performed on key cyber terrain. On area of concern is the company’s SMTP services. The security assessor wants to run reconnaissance before taking any additional action and wishes to determine which SMTP server is Internet-facing.

Which of the following commands should the assessor use to determine this information?

65. As part of a systems modernization program, the use of a weak encryption algorithm is identified m a wet se-vices API. The client using the API is unable to upgrade the system on its end which would support the use of a secure algorithm set As a temporary workaround the client provides its IP space and the network administrator Limits access to the API via an ACL to only the IP space held by the client .

Which of the following is the use of the ACL in this situation an example of?

66. CORRECT TEXT

An administrator wants to install a patch to an application.



INSTRUCTIONS

Given the scenario, download, verify, and install the patch in the most secure manner.

The last install that is completed will be the final submission.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

67. During a security assessment, an organization is advised of inadequate control over network segmentation. The assessor explains that the organization’s reliance on VLANs to segment traffic is insufficient to provide segmentation based on regulatory standards.

Which of the following should the organization consider implementing along with VLANs to provide a greater level of segmentation?

68. A security engineer is assessing a new IoT product. The product interfaces with the ODBII port of a vehicle and uses a Bluetooth connection to relay data to an onboard data logger located in the vehicle. The data logger can only transfer data over a custom USB cable.

The engineer suspects a relay attack is possible against the cryptographic implementation used to secure messages between segments of the system .

Which of the following tools should the engineer use to confirm the analysis?

69. Ann, a terminated employee, left personal photos on a company-issued laptop and no longer has access to them. Ann emails her previous manager and asks to get her personal photos back .

Which of the following BEST describes how the manager should respond?

70. A developer needs to provide feedback on a peer’s work during the SDLC. While reviewing the code changes, the developers session ID tokens for a web application will be transmitted over an unsecure connection .

Which of the following code snippets should the developer recommend implement to correct the vulnerability?

A)





B)





C)





D)

71. Within the past six months, a company has experienced a series of attacks directed at various collaboration tools. Additionally, sensitive information was compromised during a recent security breach of a remote access session from an unsecure site.

As a result, the company is requiring all collaboration tools to comply with the following:

✑ Secure messaging between internal users using digital signatures

✑ Secure sites for video-conferencing sessions

✑ Presence information for all office employees

✑ Restriction of certain types of messages to be allowed into the network.

Which of the following applications must be configured to meet the new requirements? (Select TWO.)

72. An organization is reviewing endpoint security solutions.

In evaluating products, the organization has the following requirements:

✑ Support server, laptop, and desktop infrastructure

✑ Due to limited security resources, implement active protection capabilities

✑ Provide users with the ability to self-service classify information and apply policies

✑ Protect data-at-rest and data-in-use

Which of the following endpoint capabilities would BEST meet the above requirements? (Select two.)

73. DRAG DROP

A vulnerability scan with the latest definitions was performed across Sites A and B.

Match each relevant finding to the affected host-After associating the finding with the appropriate host(s), click the host to select the appropriate corrective action for that finding.

74. A bank is initiating the process of acquiring another smaller bank.

Before negotiations happen between the organizations, which of the following business documents would be used as the FIRST step in the process?

75. Following a security assessment, the Chief Information Security Officer (CISO) is reviewing the results of the assessment and evaluating potential risk treatment strategies. As part of the CISO’s evaluation, a judgment of potential impact based on the identified risk is performed. To prioritize response actions, the CISO uses past experience to take into account the exposure factor as well as the external accessibility of the weakness identified.

Which of the following is the CISO performing?

76. An organization is creating requirements for new laptops that will be issued to staff One of the company's key security objectives is to ensure the laptops nave hardware-enforced data-at-rest protection tied to permanent hardware identities. The laptops must also provide attestation for secure boot processes.

To meet these demands, which of the following BEST represent the features that should be included in the requirements set? (Select TWO.)

77. A legal services company wants to ensure emails to clients maintain integrity in transit.

Which of the following would BEST meet this requirement? (Select TWO)

78. Following the successful response to a data-leakage incident, the incident team lead facilitates an exercise that focuses on continuous improvement of the organization’s incident response capabilities .

Which of the following activities has the incident team lead executed?

79. A Chief Information Security Officer (CISO) implemented MFA for all accounts in parallel with the BYOD policy. After the implementation, employees report the increased authentication method is causing increased time to tasks. This applies both to accessing the email client on the workstation and the online collaboration portal .

Which of the following should be the CISO implement to address the employees’ concerns?

80. A system owner has requested support from data owners to evaluate options for the disposal of equipment containing sensitive data. Regulatory requirements state the data must be rendered unrecoverable via logical means or physically destroyed .

Which of the following factors is the regulation intended to address?

81. A consultant is planning an assessment of a customer-developed system. The system consists of a custom-engineered board with modified open-source drivers and a one-off management GUI. The system relies on two- factor authentication for interactive sessions, employs strong certificate-based data-in-transit encryption, and randomly switches ports for each session .

Which of the following would yield the MOST useful information'?

82. The Chief information Officer (CIO) wants to establish a non-banding agreement with a third party that outlines the objectives of the mutual arrangement dealing with data transfers between both organizations before establishing a format partnership .

Which of the follow would MOST likely be used?

83. An engineer maintains a corporate-owned mobility infrastructure, and the organization requires that all web browsing using corporate-owned resources be monitored.

Which of the following would allow the organization to meet its requirement? (Choose two.)

84. After investigating virus outbreaks that have cost the company $1000 per incident, the company’s Chief Information Security Officer (CISO) has been researching new antivirus software solutions to use and be fully supported for the next two years.

The CISO has narrowed down the potential solutions to four candidates that meet all the company’s performance and capability requirements:





Using the table above, which of the following would be the BEST business-driven choice among five possible solutions?

85. CORRECT TEXT

You are a security analyst tasked with interpreting an Nmap scan output from Company A's privileged network.

The company's hardening guidelines indicate the following:

• There should be one primary server or service per device.

• Only default ports should be used.

• Non-secure protocols should be disabled.



INSTRUCTIONS

Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed.

For each device found, add a device entry to the Devices Discovered list, with the following information:

• The IP address of the device

• The primary server or service of the device

• The protocol(s) that should be disabled based on the hardening guidelines

86. There have been several exploits to critical devices within the network. However, there is currently no process to perform vulnerability analysis .

Which the following should the security analyst implement during production hours to identify critical threats and vulnerabilities?

87. A company is the victim of a phishing and spear-phishing campaign Users are Clicking on website links that look like common bank sites and entering their credentials accidentally A security engineer decides to use a layered defense to prevent the phishing or lessen its impact.

Which of the following should the security engineer implement? (Select TWO)

88. A company is purchasing an application that will be used to manage all IT assets as well as provide an incident and problem management solution for IT activity. The company narrows the search to two products. Application A and Application B; which meet all of its requirements. Application A is the most cost-effective product, but it is also the riskiest so the company purchases Application B .

Which of the following types of strategies did the company use when determining risk appetite?

89. During an audit, it was determined from a sample that four out of 20 former employees were still accessing their email accounts An information security analyst is reviewing the access to determine if the audit was valid.

Which of the following would assist with the validation and provide the necessary documentation to audit?

90. A hospital is deploying new imaging softwares that requires a web server for access to image for both local and remote users. The web server allows user authentication via secure LDAP. The information security officer wants to ensure the server does not allow unencrypted access to the imaging server by using Nmap to gather additional information.

Given the following.

* The imaging server IP is 192.168.101.24

* The domain controller IP is 192.168.100.1

* The client machine IP is 192.168.200.37

Which of the following should be used to confirm this is the only open post on the web server?

91. A malware infection spread to numerous workstations within the marketing department. The workstations were quarantined and replaced with machines .

Which of the following represents a FINAL step in the prediction of the malware?

92. A security engineer at a company is designing a system to mitigate recent setbacks caused competitors that are beating the company to market with the new products. Several of the products incorporate propriety enhancements developed by the engineer’s company. The network already includes a SEIM and a NIPS and requires 2FA for all user access .

Which of the following system should the engineer consider NEXT to mitigate the associated risks?

93. A company’s employees are not permitted to access company systems while traveling internationally. The company email system is configured to block logins based on geographic location, but some employees report their mobile phones continue to sync email traveling.

Which of the following is the MOST likely explanation? (Select TWO.)

94. After several industry comnpetitors suffered data loss as a result of cyebrattacks, the Chief Operating Officer (COO) of a company reached out to the information security manager to review the organization’s security stance.

As a result of the discussion, the COO wants the organization to meet the following criteria:

✑ Blocking of suspicious websites

✑ Prevention of attacks based on threat intelligence

✑ Reduction in spam

✑ Identity-based reporting to meet regulatory compliance

✑ Prevention of viruses based on signature

✑ Protect applications from web-based threats

Which of the following would be the BEST recommendation the information security manager could make?

95. Given the following:





Which of the following vulnerabilities is present in the above code snippet?

96. DRAG DROP

A security consultant is considering authentication options for a financial institution. The following authentication options are available.

Drag and drop the security mechanism to the appropriate use case. Options may be used once.

97. An organization is integrating an ICS and wants to ensure the system is cyber resilient. Unfortunately, many of the specialized components are legacy systems that cannot be patched. The existing enterprise consists of mission-critical systems that require 99.9% uptime.

To assist in the appropriate design of the system given the constraints, which of the following MUST be assumed?

98. A cybersecurity analyst receives a ticket that indicates a potential incident is occurring. There has been a large in log files generated by a generated by a website containing a ‘’Contact US’’ form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign of if this is a potential incident .

Which of the following would BEST assist the analyst?

99. An internal penetration tester finds a legacy application that takes measurement input made in a text box and outputs a specific string of text related to industry requirements. There is no documentation about how this application works, and the source code has been lost .

Which of the following would BEST allow the penetration tester to determine the input and output relationship?

100. A business is growing and starting to branch out into other locations.

In anticipation of opening an office in a different country, the Chief Information Security Officer (CISO) and legal team agree they need to meet the following criteria regarding data to open the new office:

✑ Store taxation-related documents for five years

✑ Store customer addresses in an encrypted format

✑ Destroy customer information after one year

✑ Keep data only in the customer’s home country

Which of the following should the CISO implement to BEST meet these requirements? (Choose three.)

101. An insurance company has two million customers and is researching the top transactions on its customer portal. It identifies that the top transaction is currently password reset. Due to users not remembering their secret questions, a large number of calls are consequently routed to the contact center for manual password resets. The business wants to develop a mobile application to improve customer engagement in the future, continue with a single factor of authentication, minimize management overhead of the solution, remove passwords, and eliminate to the contact center.

Which of the following techniques would BEST meet the requirements? (Choose two.)

102. A network administrator is concerned about a particular server that is attacked occasionally from hosts on the Internet. The server is not critical; however, the attacks impact the rest of the network. While the company’s current ISP is cost effective, the ISP is slow to respond to reported issues. The administrator needs to be able to mitigate the effects of an attack immediately without opening a trouble ticket with the ISP. The ISP is willing to accept a very small network route advertised with a particular BGP community string .

Which of the following is the BESRT way for the administrator to mitigate the effects of these attacks?

103. A large, public university has recently been experiencing an increase in ransomware attacks against computers connected to its network. Security engineers have discovered various staff members receiving seemingly innocuous files in their email that are being run .

Which of the following would BEST mitigate this attack method?

104. A Chief Information Security Officer (CISO) is creating a security committee involving multiple business units of the corporation.

Which of the following is the BEST justification to ensure collaboration across business units?

105. A company has completed the implementation of technical and management controls as required by its adopted security, ponies and standards. The implementation took two years and consumed s the budget approved to security projects. The board has denied any further requests for additional budget .

Which of the following should the company do to address the residual risk?

106. Which of the following risks does expanding business into a foreign country carry?

107. A red team is able to connect a laptop with penetration testing tools directly into an open network port. The team then is able to take advantage of a vulnerability on the domain controller to create and promote a new enterprise administrator .

Which of the following technologies would MOST likely eliminate this attack vector m the future?

108. A company wants to configure its wireless network to require username and password authentication .

Which of the following should the system administrator implement?

109. A company is deploying a DIP solution and scanning workstations and network drives for documents that contain potential Pll and payment card data.

The results of the first scan are as follows:





The security learn is unable to identify the data owners for the specific files in a timely manner and does not suspect malicious activity with any of the detected files .

Which of the following would address the inherent risk until the data owners can be formally identified?

110. An organization’s network engineering team recently deployed a new software encryption solution to ensure the confidentiality of data at rest, which was found to add 300ms of latency to data read-write requests in storage, impacting business operations.

Which of the following alternative approaches would BEST address performance requirements while meeting the intended security objective?

111. An external red team is brought into an organization to perform a penetration test of a new network-based application. The organization deploying the network application wants the red team to act like remote, external attackers, and instructs the team to use a black-box approach .

Which of the following is the BEST methodology for the red team to follow?

112. A security analyst is trying to identify the source of a recent data loss incident. The analyst has reviewed all the for the time surrounding the identified all the assets on the network at the time of the data loss. The analyst suspects the key to finding the source was obfuscated in an application .

Which of the following tools should the analyst use NEXT?

113. A company recently implemented a variety of security services to detect various types of traffic that pose a threat to the company.

The following services were enabled within the network:

• Scan of specific subsets for vulnerabilities

• Categorizing and logging of website traffic

• Enabling specific ACLs based on application traffic

• Sending suspicious files to a third-party site for validation

A report was sent to the security team that identified multiple incidents of users sharing large amounts of data from an on-premise server to a public site. A small percentage of that data also contained malware and spyware.

Which of the following services MOST likely identified the behavior and sent the report?

114. Ann, a corporate executive, has been the recent target of increasing attempts to obtain corporate secrets by competitors through advanced, well-funded means. Ann frequently leaves her laptop unattended and physically unsecure in hotel rooms during travel. A security engineer must find a practical solution for Ann that minimizes the need for user training .

Which of the following is the BEST solution in this scenario?

115. A SaaS-based email service provider often receives reports from legitimate customers that their IP netblocks are on blacklists and they cannot send email. The SaaS has confirmed that affected customers typically have IP addresses within broader network ranges and some abusive customers within the same IP ranges may have performed spam campaigns .

Which of the following actions should the SaaS provider perform to minimize legitimate customer impact?

116. A security administrator is updating corporate policies to respond to an incident involving collusion between two systems administrators that went undetected for more than six months.

Which of the following policies would have MOST likely uncovered the collusion sooner? (Choose two.)

117. A hospital uses a legacy electronic medical record system that requires multicast for traffic between the application servers and databases on virtual hosts that support segments of the application. Following a switch upgrade, the electronic medical record is unavailable despite physical connectivity between the hypervisor and the storage being in place. The network team must enable multicast traffic to restore access to the electronic medical record. The ISM states that the network team must reduce the footprint of multicast traffic on the network.





Using the above information, on which VLANs should multicast be enabled?

118. A development team releases updates to an application regularly. The application is compiled with several standard open-source security products that require a minimum version for compatibility.

During the security review portion of the development cycle, which of the following should be done to minimize possible application vulnerabilities?

119. A recent penetration test identified that a web server has a major vulnerability. The web server hosts a critical shipping application for the company and requires 99.99% availability. Attempts to fix the vulnerability would likely break the application. The shipping application is due to be replaced in the next three months .

Which of the following would BEST secure the web server until the replacement web server is ready?

120. A company wants to perform analysis of a tool that is suspected to contain a malicious payload.

A forensic analyst is given the following snippet:

^32^[34fda19(fd^43gfd/home/user/lib/module.so.343jk^rfw(342fds43g

Which of the following did the analyst use to determine the location of the malicious payload?

121. A security analyst is investigating a series of suspicious emails by employees to the security team. The email appear to come from a current business partner and do not contain images or URLs. No images or URLs were stripped from the message by the security tools the company uses instead, the emails only include the following in plain text.





Which of the following should the security analyst perform?

122. A managed service provider is designing a log aggregation service for customers who no longer want to manage an internal SIEM infrastructure. The provider expects that customers will send all types of logs to them, and that log files could contain very sensitive entries. Customers have indicated they want on-premises and cloud-based infrastructure logs to be stored in this new service. An engineer, who is designing the new service, is deciding how to segment customers.

Which of the following is the BEST statement for the engineer to take into consideration?

123. A company is in the process of re-architecting its sensitive system infrastructure to take advantage of on-demand computing through a public cloud provider. The system to be migrated is sensitive with respect to latency availability, and integrity.

The infrastructure team agreed to the following

• Application and middleware servers will migrate to the cloud " Database servers will remain on-site

• Data backup wilt be stored in the cloud

Which of the following solutions would ensure system and security requirements are met?

124. A project manager is working with system owners to develop maintenance windows for system pathing and upgrades in a cloud-based PaaS environment. Management has indicated one maintenance windows will be authorized per month, but clients have stated they require quarterly maintenance windows to meet their obligations .

Which of the following documents should the project manager review?

125. A security is assisting the marketing department with ensuring the security of the organization’s social media platforms.

The two main concerns are:

The Chief marketing officer (CMO) email is being used department wide as the username

The password has been shared within the department

Which of the following controls would be BEST for the analyst to recommend?

126. A system administrator recently conducted a vulnerability scan of the internet. Subsequently, the organization was successfully attacked by an adversary .

Which of the following in the MOST likely explanation for why the organization network was compromised?

127. A technician receives the following security alert from the firewall’s automated system:





After reviewing the alert, which of the following is the BEST analysis?

128. One of the objectives of a bank is to instill a security awareness culture .

Which of the following are techniques that could help to achieve this? (Choose two.)

129. An internal application has been developed to increase the efficiency of an operational process of a global manufacturer. New code was implemented to fix a security bug, but it has caused operations to halt. The executive team has decided fixing the security bug is less important than continuing operations.

Which of the following would BEST support immediate rollback of the failed fix? (Choose two.)

130. A security administrator wants to stand up a NIPS that is multilayered and can incorporate many security technologies into a single platform. The product should have diverse capabilities, such as antivirus, VPN, and firewall services, and be able to be updated in a timely manner to meet evolving threats .

Which of the following network prevention system types can be used to satisfy the requirements?

131. A security analyst receives an email from a peer that includes a sample of code from a piece of malware found in an application running in the organization’s staging environment. During the incident response process, it is determined the code was introduced into the environment as a result of a compromised laptop being used to harvest credentials and access the organization’s code repository. While the laptop itself was not used to access the code repository, an attacker was able to leverage the harvested credentials from another system in the development environment to bypass the ACLs limiting access to the repositories .

Which of the following controls MOST likely would have interrupted the kill chain in this attack?

132. A security engineer is attempting to increase the randomness of numbers used in key generation in a system. The goal of the effort is to strengthen the keys against predictive analysis attacks.

Which of the following is the BEST solution?

133. During the migration of a company’s human resources application to a PaaS provider, the Chief Privacy Officer (CPO) expresses concern the vendor’s staff may be able to access data within the migrating applications. The application stack includes a multitier architecture and uses commercially available, vendor-supported software packages .

Which of the following BEST addresses the CPO’s concerns?

134. A software development team has spent the last 18 months developing a new web-based front-end that will allow clients to check the status of their orders as they proceed through manufacturing. The marketing team schedules a launch party to present the new application to the client base in two weeks. Before the launch, the security team discovers numerous flaws that may introduce dangerous vulnerabilities, allowing direct access to a database used by manufacturing. The development team did not plan to remediate these vulnerabilities during development.

Which of the following SDLC best practices should the development team have followed?

135. A security manager recently categorized an information system. During the categorization effort, the manager determined the loss of integrity of a specific information type would impact business significantly. Based on this, the security manager recommends the implementation of several solutions .

Which of the following, when combined, would BEST mitigate this risk? (Select TWO.)

136. Ann, a security administrator, is conducting an assessment on a new firewall, which was placed at the perimeter of a network containing PII.

Ann runs the following commands on a server (10.0.1.19) behind the firewall:





From her own workstation (192.168.2.45) outside the firewall, Ann then runs a port scan against the server and records the following packet capture of the port scan:





Connectivity to the server from outside the firewall worked as expected prior to executing these commands.

Which of the following can be said about the new firewall?

137. An organization just merged with an organization in another legal jurisdiction and must improve its network security posture in ways that do not require additional resources to implement data isolation. One recommendation is to block communication between endpoint PCs .

Which of the following would be the BEST solution?

138. A company recently implemented a new cloud storage solution and installed the required synchronization client on all company devices. A few months later, a breach of sensitive data was discovered. Root cause analysis shows the data breach happened from a lost personal mobile device.

Which of the following controls can the organization implement to reduce the risk of similar breaches?

139. During a routine network scan, a security administrator discovered an unidentified service running on a new embedded and unmanaged HVAC controller, which is used to monitor the company's datacenter

Port state

161/UDP open

162/UDP open

163/TCP open

The enterprise monitoring service requires SNMP and SNMPTRAP connectivity to operate .

Which of the following should the security administrator implement to harden the system?

140. Ann, a user' brings her laptop to an analyst after noticing it has been operating very slowly.

The security analyst examines the laptop and obtains the following output.





Which of the following will the analyst most likely use NEXT?

141. An attacker wants to gain information about a company's database structure by probing the database listener. The attacker tries to manipulate the company's database to see if it has any vulnerabilities that can be exploited to help carry out an attack.

To prevent this type of attack, which of the following should the company do to secure its database?

142. After the departure of a developer under unpleasant circumstances, the company is concerned about the security of the software to which the developer has access .

Which of the following is the BEST way to ensure security of the code following the incident?

143. When of the following is the BEST reason to implement a separation of duties policy?

144. A security consultant is improving the physical security of a sensitive site and takes pictures of the unbranded building to include in the report. Two weeks later, the security consultant misplaces the phone, which only has one hour of charge left on it. The person who finds the phone removes the MicroSD card in an attempt to discover the owner to return it.

The person extracts the following data from the phone and EXIF data from some files:

DCIM Images folder

Audio books folder

Torrentz

My TAX.xls

Consultancy HR Manual.doc

Camera: SM-G950F

Exposure time: 1/60s

Location: 3500 Lacey Road USA

Which of the following BEST describes the security problem?

145. An advanced threat emulation engineer is conducting testing against a client’s network. The engineer conducts the testing in as realistic a manner as possible. Consequently, the engineer has been gradually ramping up the volume of attacks over a long period of time .

Which of the following combinations of techniques would the engineer MOST likely use in this testing? (Choose three.)

146. The Chief Information Security Officer (CISO) of an established security department, identifies a customer who has been using a fraudulent credit card. The CISO calls the local authorities, and when they arrive on-site, the authorities ask a security engineer to create a point-in-time copy of the running database in their presence.

This is an example of:

147. A security analyst is validating the MAC policy on a set of Android devices. The policy was written to ensure non-critical applications are unable to access certain resources.

When reviewing dmesg, the analyst notes many entries such as:

Despite the deny message, this action was still permit following is the MOST likely fix for this issue?

148. A penetration test is being scoped for a set of web services with API endpoints. The APIs will be hosted on existing web application servers. Some of the new APIs will be available to unauthenticated users, but some will only be available to authenticated users .

Which of the following tools or activities would the penetration tester MOST likely use or do during the engagement? (Select TWO.)

149. An organization is in the process of integrating its operational technology and information technology areas. As part of the integration, some of the cultural aspects it would like to see include more efficient use of resources during change windows, better protection of critical infrastructure, and the ability to respond to incidents.

The following observations have been identified:

✑ The ICS supplier has specified that any software installed will result in lack of support.

✑ There is no documented trust boundary defined between the SCADA and corporate networks.

✑ Operational technology staff have to manage the SCADA equipment via the engineering workstation.

✑ There is a lack of understanding of what is within the SCADA network.

Which of the following capabilities would BEST improve the security position?

150. Company leadership believes employees are experiencing an increased number of cyber attacks; however, the metrics do not show this. Currently, the company uses “Number of successful phishing attacks” as a KRI, but it does not show an increase.

Which of the following additional information should be the Chief Information Security Officer (CISO) include in the report?

151. The current project scope is for internally hosted applications only.

Which of the following solution building blocks should the security architect use to BEST meet the requirements?

152. A small company needs to reduce its operating costs. vendors have proposed solutions, which all focus on management of the company’s website and services. The Chief information Security Officer (CISO) insist all available resources in the proposal must be dedicated, but managing a private cloud is not an option .

Which of the following is the BEST solution for this company?

153. A company monitors the performance of all web servers using WMI. A network administrator informs the security engineer that web servers hosting the company’s client-facing portal are running slowly today. After some investigation, the security engineer notices a large number of attempts at enumerating host information via SNMP from multiple IP addresses.

Which of the following would be the BEST technique for the security engineer to employ in an attempt to prevent reconnaissance activity?

154. A penetration tester has been contracted to conduct a physical assessment of a site .

Which of the following is the MOST plausible method of social engineering to be conducted during this engagement?

155. A company has created a policy to allow employees to use their personally owned devices. The Chief Information Officer (CISO) is getting reports of company data appearing on unapproved forums and an increase in theft of personal electronic devices .

Which of the following security controls would BEST reduce the risk of exposure?