Which of the following must be considered when designing a high-availability network? (Choose two).

A. Ease of recovery, D. Responsiveness

Which of the following describes the reason root cause analysis should be conducted as part of incident response?

D. To prevent future incidents of the same nature

A company is required to use certified hardware when building networks. Which of the following best addresses the risks

A. A thorough analysis of the supply chain

A security analyst scans a company's public network and discovers a host is running a remote desktop that can be used to

Setting up a VPN and placing the jump server inside the firewall

While troubleshooting a firewall configuration, a technician determines that a "deny any" policy should be added to the

Testing the policy in a non-production environment before enabling the poli

The local administrator account for a company's VPN appliance was unexpectedly used to log in to the remote management i

B. Changing the default password

During a security incident, the security operations team identified sustained network traffic from a malicious IP addres

B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0

Which of the following is the most likely to be included as an element of communication in a security awareness program?

A. Reporting phishing attempts or other suspicious activities

A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of th

C. Apply classifications to the data.

A network manager wants to protect the company's VPN by implementing multifactor authentication that uses: Something you

Password, authentication token, thumbprint

A company has begun labeling all laptops with asset inventory stickers and associating them with employee IDs. Which of

C. Users can be mapped to their devices when configuring software MFA token, A. If a security incident occurs on the device, the correct employee can be

studbud

Master Security+ 1

146 termsStudBud Administration1 play

Imported from external platform

Flashcards146 cardsFPractice quizPHost liveL

Questions 146

Answers

1
A small business uses kiosks on the sales floor to display product information for customers. A security team discovers
A. Patch availability
D. Cost of replacement
B. Product software compatibility
C. Ease of recovery
2
Visitors to a secured facility are required to check in with a photo ID and enter the facility through an access control
B. Managerial
A. Physical
D. Operational
C. Technical
3
A systems administrator receives the following alert from a file integrity monitoring tool: The hash of the cmd.exe file
A. The end user changed the file permissions.
C. A snapshot of the file system was taken.
D. A rootkit was deployed
B. A cryptographic collision was detected.
4
Which of the following threat actors is the most likely. to be hired by a foreign government to attack critical systems
C. Organized crime
D. Unskilled attacker
A. Hacktivist
B. Whistleblower
5
A technician is opening ports on a firewall for a new system being deployed and supported by a Saas provider. Which of t
B. Non-segmented network
C. Supply chain vendor
D. Vulnerable software
A. Default credentials
6
A systems administrator is working on a solution with the following requirements: Provide a secure zone. Enforce a compa
CIA
Zero Trust
AAA
Non-repudation
7
A company hired a consultant to perform an offensive security assessment covering penetration testing and social enginee
Which of the following teams will conduct this assessment activity?
D. Red
B. Purple
A. White
8
A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks.
Incident Response
E-discovery
Digital Forensics
Threat Hunting
9
Which of the following must be considered when designing a high-availability network? (Choose two).
A. Ease of recovery
C. Physical isolation
B. Ability to patch
D. Responsiveness
10
Which of the following describes the reason root cause analysis should be conducted as part of incident response?
D. To prevent future incidents of the same nature
A. To gather loCs for the investigation
B. To discover which systems have been affected
C. To eradicate any trace of malware on the network
11
A security operations center determines that the malicious activity detected on a server is normal. Which of the followi
Quarantining
Tuning
Aggregating
Archiving
12
A company is required to use certified hardware when building networks. Which of the following best addresses the risks
A. A thorough analysis of the supply chain
D. An in-depth penetration test of all suppliers and vendors
B. A legally enforceable corporate acquisition policy
C. A right to audit clause in vendor contracts and SOWs
13
Which of the following is the phase in the incident response process when a security analyst reviews roles and responsib
D. Analysis
A. Preparation
B. Recovery
C. Lessons learned
14
Which of the following is the most common data loss path for an air-gapped network?
C. Unpatched OS
A. Bastion host
B. Unsecured Bluetooth
D. Removable devices
15
The management team notices that new accounts that are set up manually do not always have correct access or permissions.
Which of the following automation techniques should a systems administrator
B. Ticketing workflow
A. Guard rail script
D. User provisioning script
16
Which of the following vulnerabilities is associated with installing software outside of a manufacturer's approved softw
B. Memory injection
C. Resource reuse
A. Jailbreaking
D. Side loading
17
A security analyst scans a company's public network and discovers a host is running a remote desktop that can be used to
Setting up a VPN and placing the jump server inside the firewall
Changing the remote desktop port to a non-standard number
C. Using a proxy for web connections from the remote desktop server
D. Connecting the remote server to the domain and increasing the password l
18
Which of the following is the best reason to complete an audit in a banking environment?
C. Self-assessment requirement
B. Organizational change
D. Service-level requirement
A. Regulatory requirement
19
While troubleshooting a firewall configuration, a technician determines that a "deny any" policy should be added to the
Testing the policy in a non-production environment before enabling the poli
Documenting the new policy in a change request and submitting the request t
C. Disabling any intrusion prevention signatures on the "deny any" policy p
D. Including an "allow any" policy above the "deny any" policy
20
A company is planning to set up a SIEM system and assign an analyst to review the logs on a weekly basis. Which of the f
A. Corrective
C. Detective
B. Preventive
D. Deterrent
21
A company prevented direct access from the database administrators' workstations to the network segment that contains da
D. Load balancer
B. RADIUS
C. HSM
A. Jump server
22
An employee receives a text message that appears to have been sent by the payroll department and is asking for credentia
A. Typosquatting
B. Phishing
E. Smishing
C. Impersonation
23
Which of the following allows for the attribution of messages to individuals?
C. Authentication
B. Non-repudiation
A. Adaptive identity
D. Access logs
24
The local administrator account for a company's VPN appliance was unexpectedly used to log in to the remote management i
A. Using least privilege
C. Assigning individual user IDs
B. Changing the default password
25
A company is working with a vendor to perform a penetration test. Which of the following includes an estimate about the
C. SLA
D. NDA
B. BPA
A. SOW
26
A company is planning a disaster recovery site and needs to ensure that a single natural disaster would not result in th
D. Load balancing
C. Hot site
B. Platform diversity
A. Geographic dispersion
27
A penetration tester begins an engagement by performing port and service scans against the client environment according
Active
Defensive
Passive
Offensive
28
During a security incident, the security operations team identified sustained network traffic from a malicious IP addres
B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
C. access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
D. access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32
A. access-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
29
An employee clicked a link in an email from a payment website that asked the employee to update contact information. The
Pretexting
Brand impersonation
Typosquatting
Phishing
30
Which of the following is the best way to consistently determine on a daily basis whether security settings on servers h
D. Manual audit
A. Automation
C. Attestation
B. Compliance checklist
31
Which of the following is the most likely to be included as an element of communication in a security awareness program?
B. Detecting insider threats using anomalous behavior recognition
A. Reporting phishing attempts or other suspicious activities
C. Verifying information when modifying wire transfer data
D. Performing social engineering as part of third-party penetration testi
32
A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attack
A. MTTR
D. MTBF
B. RTO
C. ARO
33
An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of
D. Compensating controls
A. Exception
C. Risk transfer
B. Segmentation
34
A systems administrator is creating a script that would save time and prevent human error when performing account creati
C. Baseline
A. Off-the-shelf software
B. Orchestration
D. Policy enforcement
35
A systems administrator is looking for a low-cost application-hosting solution that is cloud-based. Which of the followi
C. SD-WAN
B. Type 1 hypervisor
A. Serverless framework
D. SDN
36
A company is required to perform a risk assessment on an annual basis. Which of the following types of risk assessments
B. Ad hoc
D. One time
G. Recurring
A. Continuous
37
During an investigation, an incident response team attempts to understand the source of an incident. Which of the follow
D. Containment
C. Detection
A. Analysis
B. Lessons learned
38
A company is developing a business continuity strategy and needs to determine how many staff members would be required t
D. Tabletop exercise
A. Capacity planning
B. Redundancy
C. Geographic dispersion
39
Which of the following exercises should an organization use to improve its incident response process?
A. Tabletop
B. Replication
D. Recovery
C. Failover
40
A security analyst locates a potentially malicious video file on a server and needs to identify both the creation date a
C. Check endpoint logs.
A. Obtain the file's SHA-256 hash.
D. Query the file's metadata.
B. Use hedump on the file's contents.
41
A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of th
A. Block access to cloud storage websites.
B. Create a rule to block outgoing email attachments.
D. Remove all user permissions from shares on the file server.
C. Apply classifications to the data.
42
A network manager wants to protect the company's VPN by implementing multifactor authentication that uses: Something you
Domain name, PKI, GeolP lookup
Password, authentication token, thumbprint
Company URL, TLS certificate, home address
VPN IP address, company ID, facial structure
43
A company's web filter is configured to scan the URL for strings and deny access when matches are found. Which of the fo
http://
www.*.com
:443
encryption=off
44
A company has begun labeling all laptops with asset inventory stickers and associating them with employee IDs. Which of
C. Users can be mapped to their devices when configuring software MFA token
A. If a security incident occurs on the device, the correct employee can be
B. The security team will be able to send user awareness training to the ap
D. User-based firewall policies can be correctly targeted to the appropriat
45
Which of the following security control types does an acceptable use policy best represent?
A. Detective
B. Compensating
C. Corrective
D. Preventive
46
Which of the following is the most likely outcome if a large bank fails an internal PCI DSS compliance assessment?
B. Audit findings
D. Reputation damage
C. Sanctions
A. Fines
47
A client asked a security company to provide a document outlining the project, the cost, and the completion time frame.
C. BPA
D. SOW
A. MSA
B. SLA
48
Which of the following roles, according to the shared responsibility model, is responsible for securing the company's da
B. Third-party vendor
C. Cloud provider
D. DBA
A. Client
49
Employees in the research and development business unit receive extensive training to ensure they understand how to best
Critical
Intellectual property
Encrypted
Data in Transit
50
Which of the following tools can assist with detecting. an employee who has accidentally emailed a file containing a cus
D. DLP
B. NetFlow
C. Antivirus
A. SCAP
51
A company's marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is resp
B. Custodian
C. Subject
D. Owner
A. Processor
52
A software development manager wants to ensure the authenticity of the code created by the company. Which of the followi
D. Ensuring secure cookies are use
C. Performing static code analysis on the software
B. Performing code signing on company-developed software
A. Testing input validation on the user input fields
53
Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Choose
B. Video surveillance
D. Access control vestibule
A. Fencing
C. Badge access
54
Which of the following describes the maximum allowance of accepted risk?
C. Risk score
B. Risk level
D. Risk threshold
A. Risk indicator
55
A technician wants to improve the situational and environmental awareness of existing users as they transition from remo
A. Send out periodic security reminders.
B. Update the content of new hire documentation.
D. Implement a phishing campaign.
C. Modify the content of recurring training.
56
After a security awareness training session, a user called the IT help desk and reported a suspicious call.
A. Insider threat
C. Social engineering
The suspicious caller stated that the Chief Financial Officer wanted credit
B. Email phishing
57
A legacy device is being decommissioned and is no longer receiving updates or patches. Which of the following describes
D. End of life
A. End of business
B. End of testing
C. End of support
58
Which of the following best practices gives administrators a set period to perform changes to an operational system to e
B. Scheduled downtime
C. Backout plan
D. Change management boards
A. Impact analysis
59
A client demands at least 99.99% uptime from a service provider's hosted security services. Which of the following docum
C. MOU
D. SLA
A. MOA
B. SOW
60
Which of the following would be best suited for constantly changing environments?
D. SCADA
A. RTOS
B. Containers
C. Embedded systems
61
Which of the following should a security administrator adhere to when setting up a new set of firewall rules?
B. Incident response procedure
A. Disaster recovery plan
D. Change management procedure
C. Business continuity plan
62
An enterprise has been experiencing attacks focused on exploiting vulnerabilities in older browser versions with well-kn
B. DLP
D. IPS
A. ACL
C. IDS
63
Which of the following is required for an organization to properly manage its restore process in the event of system fai
DRP
IRP
SDLC
RPO
64
Which of the following scenarios describes a possible business email compromise attack?
B. Employees who open an email attachment receive messages demanding paym
C. A service desk employee receives an email from the HR director asking fo
D. An employee receives an email with a link to a phishing site that is des
A. An employee receives a gift card request in an email that has an execu
65
Which of the following can be used to identify potential attacker activities without affecting production servers?
A. Honeypot
B. Video surveillance
D. Geofencing
C. Zero Trust
66
A company is discarding a classified storage array and hires an outside vendor to complete the disposal. Which of the fo
Inventory Lsit
Classification
Certification
Proof of Ownership
67
Which of the following practices would be best to prevent an insider from introducing malicious code into a company's de
A. Code scanning for vulnerabilities
D. Peer review and approval
C. Quality assurance testing
B. Open-source component usage
68
Which of the following is used to quantitatively measure the criticality of a vulnerability?
A. CVE
D. CERT
B. CVSS
C. CIA
69
An administrator assists the legal and compliance team with ensuring information about customer transactions is archived
Retention
Transfer
Analysis
Compromise
70
Which of the following security concepts is the best reason for permissions on a human resources file share to follow th
B. Availability
D. Non-repudiation
A. Integrity
C. Confidentiality
71
A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following strategies is the ban
C. Data classification
D. Permission restrictions
B. Masking
A. Encryption at rest
72
A security analyst receives alerts about an internal system sending a large amount of unusual DNS queries to systems on
B. Data is being exfiltrated.
A. A worm is propagating across the network.
D. Ransomware is encrypting files.
C. A logic bomb is deleting data.
73
An employee receives a text message from an unknown number claiming to be the company's Chief Executive Officer and aski
C. Pretexting
A. Vishing
B. Smishing
D. Phishing
74
A technician needs to apply a high-priority patch to a production system. Which of the following steps should be taken f
C. Create a change control request.
A. Air gap the system.
D. Apply the patch to the system.
B. Move the system to a different network segment.
75
A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does
B. Transfer
C. Mitigate
E. Avoid
A. Accept
76
Which of the following describes a security alerting and monitoring tool that collects system, application, and network
B. DLP
D. SNMP
C. IDS
A. SIEM
77
Which of the following is used to add extra complexity before using a one-way data transformation algorithm?
C. Steganography
B. Data masking
D. Salting
A. Key stretching
78
During the onboarding process, an employee needs to create a password for an intranet account. The password must include
Default password changes
Identity Proofing
Password Complexity
Federation
79
Which of the following should a systems administrator use to ensure an easy deployment of resources within the cloud pro
Software as a service
Infrastructure as code
Internet of Things
Software-defined networking
80
After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which o
D. Web-based administration
A. Console access
C. VLANS
B. Routing protocols
81
Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?
C. Risk register
D. Risk analysis
A. Risk tolerance
B. Risk transfer
82
Which of the following provides the details about the terms of a test with a third-party penetration tester?
C. Right to audit clause
A. Rules of engagement
D. Due diligence
B. Supply chain analysis
83
A company is expanding its threat surface program and allowing individuals to security test the company's internet-facin
B. Bug bounty
D. Penetration testing
A. Open-source intelligence
C. Red team
84
Which of the following is used to validate a certificate when it is presented to a user?
CA
NCRC
OCSP
CSR
85
Which of the following would be the best way to block unknown programs from executing?
A. Access control list
B. Application allow list
C. Host-based firewall
D. DLP solution
86
Which of the following describes the process of concealing code or text inside a graphical image?
D. Steganography
C. Data masking
B. Hashing
A. Symmetric encryption
87
An engineer needs to find a solution that creates an added layer of security by preventing unauthorized access to intern
Hypervisor
Jump server
Proxy server
RDP server
88
Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from
B. Network segmentation
C. Transfer of risk
D. SNMP traps
A Compensating control
89
An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users,
D. Password complexity
A. Multifactor authentication
B. Permissions assignment
C. Access management
90
A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-se
D. Organized crime
A. Insider threat
C. Nation-state
B. Hacktivist
91
An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to remote work. The o
B. Building a load-balanced VPN solution with redundant internet
A. Deploying a SASE solution to remote employees
D. Using a cloud provider to create additional VPN concentrators
C. Purchasing a low-cost SD-WAN solution for VPN traffic
92
A security team is reviewing the findings in a report that was delivered after a third party performed a penetration tes
D. Code signing
A. Secure cookies
B. Version control
C. Input validation
93
An organization's internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the fol
NGFW
WAF
TLS
SD-WAN
94
A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most importan
D. Data tokenization
C. Digital signatures
A. Key escrow
B. TPM presence
95
A newly appointed board member with cybersecurity knowledge wants the board of directors to receive a quarterly report d
D. Dashboard
C. Metadata
B. Vulnerability scans
A. Packet captures
96
A company needs to provide administrative access to internal resources while minimizing the traffic allowed through the
E. Utilizing single sign-on
B. Deploying a perimeter network
C. Installing a WAF
A. Implementing a bastion host
97
After reviewing the following vulnerability scanning report: Server: 192.168.14.6 Service: Telnet Port: 23 Protocol: TCP
It is a false positive.
It is considered noise.
A rescan is required
Compenasating controls exist.
98
A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the fol
C. Destruction
B. Sanitization
D. Inventory
A. Enumeration
99
Which of the following is a hardware-specific vulnerability?
A. Firmware version
C. SQL injection
B. Buffer overflow
D. Cross-site scripting
100
A company's end users are reporting that they are unable to reach external websites. After reviewing the performance dat
D. Reflected denial of service
B. Secure DNS cryptographic downgrade
C. On-path resource consumption
A. Concurrent session usage
101
One of a company's vendors sent an analyst a security bulletin that recommends a BIOS update. Which of the following vul
Operating System
Firmware
Virtualization
Application
102
A security analyst and the management team are reviewing the organizational performance of a recent phishing campaign. T
C. Update the EDR policies to block automatic execution of downloaded progr
A. Place posters around the office to raise awareness of common phishing ac
D. Create additional training for users to recognize the signs of phishin
B. Implement email security filters to prevent phishing emails from being
103
A security analyst is reviewing the following logs: [10: 00:00AM] Login Rejected – Username administrator – password
Password Spraying
Account Forgery
Pass the hash
Brute Force
104
A security consultant needs secure, remote access to a client environment. Which of the following should the security co
A. EAP
B. DHCP
C. IPSec
E. NAT
105
A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employe
B. IPS/IDS
D. Endpoint
A. Application
C. Network
106
Which of the following best ensures minimal downtime and data loss for organizations with critical computing equipment l
B. Off-site replication
A. Generators and UPS
D. High availability networking
C. Redundant cold sites
107
A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credent
A. SSO
C. MFA
D. PEAP
B. LEAP
108
Security controls in a data center are being reviewed to ensure data is properly protected and that human life considera
D. Logical security controls should fail closed.
C. Safety controls should fail open.
B. Logging controls should fail open.
A. Remote access points should fail closed.
109
An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will
D. Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53 Access list
C. Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53 Access list outb
A. Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53 Access list outb
B. Access list outbound permit 0.0.0.0/0 10.50.10.25/32 port 53 Access list
110
A security administrator needs a method to secure data in an environment that includes some form of checks so track any
A. SPF
B. GPO
D. FIM
C. NAC
111
Which of the following can best protect against an employee inadvertently installing malware on a company system?
B. System isolation
C. Least privilege
A. Host-based firewall
D. Application allow list
112
An organization is building a new backup data center with cost-benefit as the primary requirement and RTO and RPO values
C. Cold
B. Hot
D. Warm
A. Real-time recovery
113
Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The
Which of the following are the best responses to this situation? (Choose tw
B. Add a smishing exercise to the annual company training.
C. Issue a general email warning to the company.
"I'm in an airport right now with no access to email. I need you to buy gif
114
After an audit, an administrator discovers all users have access to confidential data on a file server. Which of the fol
Content Filtering
Access Control Lists
Data Loss Prevention
Group Policy
115
A newly identified network access vulnerability has been found in the OS of legacy loT devices. Which of the following w
B. Patching
C. Segmentation
A. Insurance
D. Replacement
116
A security practitioner completes a vulnerability assessment on a company's network and finds several vulnerabilities, w
A. Conduct an audit.
C. Rescan the network.
B. Initiate a penetration test.
D. Submit a report.
117
After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security
C. Retain any communications between security members during the breach r
B. Retain any communications related to the security breach until further n
D. Retain all emails from the company to affected customers for an indefi
A. Retain the emails between the security team and affected customers for
118
A company is concerned about weather events causing damage to the server room and downtime. Which of the following shoul
C. Load balancers
B. Geographic dispersion
A. Clustering servers
D. Off-site backups
119
A security administrator would like to protect data on employees' laptops. Which of the following encryption techniques
B. Asymmetric
A. Partition
D. Database
C. Full disk
120
Which of the following incident response activities ensures evidence is properly handled?
D. Preservation
B. Chain of custody
A. E-discovery
C. Legal hold
121
Which of the following teams combines both offensive and defensive testing techniques to protect an organization's criti
A. Red
C. Purple
B. Blue
D. Yellow
122
After a recent ransomware attack on a company's system, an administrator reviewed the log files. Which of the following
A. Compensating
B. Detective
D. Corrective
C. Preventive
123
Which of the following risk management strategies should an enterprise adopt first if a legacy application is critical t
D. Avoid
A. Mitigate
B. Accept
C. Transfer
124
Which of the following is a primary security concern for a company setting up a BYOD program?
D. Jailbreaking
C. VM escape
A. End of life
B. Buffer overflow
125
A company is adding a clause to its AUP that states employees are not allowed to modify the operating system on mobile d
A. Cross-site scripting
D. Side loading
B. Buffer overflow
C. Jailbreaking
126
Which of the following enables the use of an input field to run commands that can view or manipulate data?
B. Side loading
D. SQL injection
A. Cross-site scripting
C. Buffer overflow
127
An organization would like to store customer data on a separate part of the network that is not accessible to users on t
A. Segmentation
C. Patching
D. Encryption
B. Isolation
128
An organization is leveraging a VPN between its headquarters and a branch location. Which of the following is the VPN pr
B. Data in transit
C. Data sovereignty
C. Geographic restrictions
A. Data in use
129
An IT manager informs the entire help desk staff that only the IT manager and the help desk lead will have access to the
D. Least privilege
C. Configuration enforcement
A. Hardening
B. Employee monitoring
130
An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal
D. Insider threat
Which of the following best describes the user's activity?
B. Phishing campaign
A. Penetration testing
131
A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of th
B. Critical
C. Sensitive
D. Public
A. Private
132
Which of the following are cases in which an engineer should recommend the decommissioning of a network device? (Choose
A. The device has been moved from a production environment to a test envi
E. The device's encryption level cannot meet organizational standards.
F. The device is unable to receive authorized updates.
B. The device is configured to use cleartext passwords.
133
An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of the following would
D. Threat scope reduction
B. Subject role
C. Adaptive identity
A. Secured zones
134
Which of the following would be the best way to handle a critical business application that is running on a legacy serve
A. Segmentation
B. Isolation
C. Hardening
D. Decommissioning
135
A company's legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot
B. Encryption
C. Geolocation policy
D. Data sovereignty regulation
A. Data masking
136
An accounting clerk sent money to an attacker's bank account after receiving fraudulent instructions to use a new accoun
C. Implementing insider threat detection measures
D. Updating processes for sending wire transfers
A. Standardizing security incident reporting
B. Executing regular phishing campaigns
137
Which of the following vulnerabilities is exploited when an attacker overwrites a register with a malicious address?
C. Buffer overflow
A. VM escape
B. SQL injection
D. Race condition
138
A security analyst reviews domain activity logs and notices the following: UserID jsmith, password authentication: succe
B. A keylogger is installed on smith's workstation.
A. The user jsmith's account has been locked out.
C. An attacker is attempting to brute force smith's account.
D. Ransomware has been deployed in the domain.
139
Which of the following would help ensure a security analyst is able to accurately measure the overall risk to an organiz
A. A full inventory of all hardware and software
B. Documentation of system classifications
D. Third-party risk assessment documentation
C. A list of system owners and their departments
140
A company must ensure sensitive data at rest is rendered unreadable. Which of the following will the company most likely
A. Hashing
C. Encryption
B. Tokenization
D. Segmentation
141
Malware spread across a company's network after an employee visited a compromised industry blog. Which of the following
Impersonation
Disinformation
Watering hole
Smishing
142
Which of the following actions could a security engineer take to ensure workstations and servers are properly monitored
A. Configure all systems to log scheduled tasks.
B. Collect and monitor all traffic exiting the network.
C. Block traffic based on known malicious signatures.
D. Install endpoint management software on all systems
143
An organization recently updated its security policy to include the following statement: Regular expressions are include
C. Input validation
B. Code debugging
A. Identify embedded keys
D. Static code analysis
144
Which of the following threat actors is the most likely to use large financial resources to attack critical systems loca
A. Insider
D. Hacktivist
C. Nation-state
B. Unskilled attacker
145
Which of the following involves an attempt to take advantage of database misconfigurations?
C. VM escape
D. Memory Injection
A. Buffer overflow
B. SQL injection
146
A systems administrator wants to prevent users from being able to access data based on their responsibilities. The admin
B. ACL
A. RBAC
C. SAML
D. GPO

Master Security+ 1 Flashcards | StudBud