Which of the following is the most important security concern when using legacy systems to provide production service?

A. Instability

B. Lack of vendor support

C. Loss of availability

D. Use of insecure protocols

A network manager wants to protect the company's VPN by implementing multifactor authentication that uses:
Something you know -
Something you have -
Something you are -
Which of the following would accomplish the manager's goal?

A. Domain name, PKI, GeoIP lookup

B. VPN IP address, company ID, facial structure

C. Password, authentication token, thumbprint

D. Company URL, TLS certificate, home address

An organization recently updated its security policy to include the following statement:
Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and ? from variables set by forms in a web application.
Which of the following best explains the security technique the organization adopted by making this addition to the policy?

A. Identify embedded keys

B. Code debugging

C. Input validation

D. Static code analysis

An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users, the administrator determines that the employees were not logging in from those IP addresses and resets the affected users’ passwords. Which of the following should the administrator implement to prevent this type of attack from succeeding in the future?

A. Multifactor authentication

B. Permissions assignment

C. Access management

D. Password complexity

An organization would like to store customer data on a separate part of the network that is not accessible to users on the main corporate network. Which of the following should the administrator use to accomplish this goal?

A. Segmentation

B. Isolation

C. Patching

D. Encryption

Which of the following exercises should an organization use to improve its incident response process?

A. Tabletop

B. Replication

C. Failover

D. Recovery

A security analyst and the management team are reviewing the organizational performance of a recent phishing campaign. The user click-through rate exceeded the acceptable risk threshold, and the management team wants to reduce the impact when a user clicks on a link in a phishing message. Which of the following should the analyst do?

A. Place posters around the office to raise awareness of common phishing activities.

B. Implement email security filters to prevent phishing emails from being delivered.

C. Update the EDR policies to block automatic execution of downloaded programs.

D. Create additional training for users to recognize the signs of phishing attempts.

A Chief Information Security Officer would like to conduct frequent, detailed reviews of systems and procedures to track compliance objectives. Which of the following will be the best method to achieve this objective?

A. Third-party attestation

B. Penetration testing

C. Internal auditing

D. Vulnerability scans

A company hired an external consultant to assist with required system upgrades to a critical business application. A systems administrator needs to secure the consultant's access without sharing passwords to critical systems. Which of the following solutions should most likely be utilized?

A. TACACS+

B. SAML

C. An SSO platform

D. Role-based access control

E. PAM software

The Chief Information Security Officer (CISO) has determined the company is non-compliant with local data privacy regulations. The CISO needs to justify the budget request for more resources. Which of the following should the CISO present to the board as the direct consequence of non-compliance?

A. Fines

B. Reputational damage

C. Sanctions

D. Contractual implications

An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period. Which of the following data policies is the administrator carrying out?

A. Compromise

B. Retention

C. Analysis

D. Transfer

E. Inventory

An employee receives a text message from an unknown number claiming to be the company’s Chief Executive Officer and asking the employee to purchase several gift cards. Which of the following types of attacks does this describe?

A. Vishing

B. Smishing

C. Pretexting

D. Phishing

While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?

A. Hard drive

B. RAM

C. SSD

D. Temporary files

A client asked a security company to provide a document outlining the project, the cost, and the completion time frame. Which of the following documents should the company provide to the client?

A. MSA

B. SLA

C. BPA

D. SOW

After a recent ransomware attack on a company's system, an administrator reviewed the log files. Which of the following control types did the administrator use?

A. Compensating

B. Detective

C. Preventive

D. Corrective

An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device.
Which of the following best describes the user’s activity?

A. Penetration testing

B. Phishing campaign

C. External audit

D. Insider threat

A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications. Which of the following methods would allow this functionality?

A. SSO

B. LEAP

C. MFA

D. PEAP

A new employee logs in to the email system for the first time and notices a message from human resources about onboarding. The employee hovers over a few of the links within the email and discovers that the links do not correspond to links associated with the company. Which of the following attack vectors is most likely being used?

A. Business email

B. Social engineering

C. Unsecured network

D. Default credentials

After reviewing the following vulnerability scanning report:
 
A security analyst performs the following test:
 
Which of the following would the security analyst conclude for this reported vulnerability?

A. It is a false positive.

B. A rescan is required.

C. It is considered noise.

D. Compensating controls exist.

Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?

A. SCAP

B. NetFlow

C. Antivirus

D. DLP

A software developer released a new application and is distributing application files via the developer's website. Which of the following should the developer post on the website to allow users to verify the integrity of the downloaded files?

A. Hashes

B. Certificates

C. Algorithms

D. Salting

A technician wants to improve the situational and environmental awareness of existing users as they transition from remote to in-office work. Which of the following is the best option?

A. Send out periodic security reminders.

B. Update the content of new hire documentation.

C. Modify the content of recurring training.

D. Implement a phishing campaign.

During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user's intranet account? (Choose two.)

A. Federation

B. Identity proofing

C. Password complexity

D. Default password changes

E. Password manager

F. Open authentication

An organization wants to improve the company's security authentication method for remote employees. Given the following requirements:
•	Must work across SaaS and internal network applications
•	Must be device manufacturer agnostic
•	Must have offline capabilities
Which of the following would be the most appropriate authentication method?

A. Username and password

B. Biometrics

C. SMS verification

D. Time-based tokens

A security analyst is reviewing the following logs:
 
Which of the following attacks is most likely occurring?

A. Password spraying

B. Account forgery

C. Pass-the-hash

D. Brute-force

After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?

A. Console access

B. Routing protocols

C. VLANs

D. Web-based administration

Which of the following considerations is the most important regarding cryptography used in an IoT device?

A. Resource constraints

B. Available bandwidth

C. The use of block ciphers

D. The compatibility of the TLS version

Which of the following enables the use of an input field to run commands that can view or manipulate data?

A. Cross-site scripting

B. Side loading

C. Buffer overflow

D. SQL injection

A security administrator needs a method to secure data in an environment that includes some form of checks so track any changes. Which of the following should the administrator set up to achieve this goal?

A. SPF

B. GPO

C. NAC

D. FIM

A security administrator is working to secure company data on corporate laptops in case the laptops are stolen. Which of the following solutions should the administrator consider?

A. Disk encryption

B. Data loss prevention

C. Operating system hardening

D. Boot security

Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Choose two.)

A. Fencing

B. Video surveillance

C. Badge access

D. Access control vestibule

E. Sign-in sheet

F. Sensor

A network administrator is working on a project to deploy a load balancer in the company's cloud environment. Which of the following fundamental security requirements does this project fulfil?

A. Privacy

B. Integrity

C. Confidentiality

D. Availability

A company is concerned about weather events causing damage to the server room and downtime. Which of the following should the company consider?

A. Clustering servers

B. Geographic dispersion

C. Load balancers

D. Off-site backups

After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice. Which of the following topics did the user recognize from the training?

A. Insider threat

B. Email phishing

C. Social engineering

D. Executive whaling

Which of the following is used to validate a certificate when it is presented to a user?

A. OCSP

B. CSR

C. CA

D. CRC

Which of the following is a possible factor for MFA?

A. Something you exhibit

B. Something you have

C. Somewhere you are

D. Someone you know

An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Choose two.)

A. Disable default accounts.

B. Add the server to the asset inventory.

C. Remove unnecessary services.

D. Document default passwords.

E. Send server logs to the SIEM.

F. Join the server to the corporate domain.

Users at a company are reporting they are unable to access the URL for a new retail website because it is flagged as gambling and is being blocked. Which of the following changes would allow users to access the site?

A. Creating a firewall rule to allow HTTPS traffic

B. Configuring the IPS to allow shopping

C. Tuning the DLP rule that detects credit card data

D. Updating the categorization in the content filter

A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?

A. Open-source intelligence

B. Bug bounty

C. Red team

D. Penetration testing

A threat actor was able to use a username and password to log in to a stolen company mobile device. Which of the following provides the best solution to increase mobile data security on all employees' company mobile devices?

A. Application management

B. Full disk encryption

C. Remote wipe

D. Containerization

Which of the following incident response activities ensures evidence is properly handled?

A. E-discovery

B. Chain of custody

C. Legal hold

D. Preservation

The marketing department set up its own project management software without telling the appropriate departments. Which of the following describes this scenario?

A. Shadow IT

B. Insider threat

C. Data exfiltration

D. Service disruption

A systems administrator wants to prevent users from being able to access data based on their responsibilities. The administrator also wants to apply the required access structure via a simplified format. Which of the following should the administrator apply to the site recovery resource group?

A. RBAC

B. ACL

C. SAML

D. GPO

Which of the following would best explain why a security analyst is running daily vulnerability scans on all corporate endpoints?

A. To track the status of patching installations

B. To find shadow IT cloud deployments

C. To continuously the monitor hardware inventory

D. To hunt for active attackers in the network

A network team segmented a critical, end-of-life server to a VLAN that can only be reached by specific devices but cannot be reached by the perimeter network. Which of the following best describe the controls the team implemented? (Choose two.)

A. Managerial

B. Physical

C. Corrective

D. Detective

E. Compensating

F. Technical

G. Deterrent

An organization completed a project to deploy SSO across all business applications last year. Recently, the finance department selected a new cloud-based accounting software vendor. Which of the following should most likely be configured during the new software deployment?

A. RADIUS

B. SAML

C. EAP

D. OpenID

An enterprise has been experiencing attacks focused on exploiting vulnerabilities in older browser versions with well-known exploits. Which of the following security solutions should be configured to best provide the ability to monitor and block these known signature-based attacks?

A. ACL

B. DLP

C. IDS

D. IPS

One of a company's vendors sent an analyst a security bulletin that recommends a BIOS update. Which of the following vulnerability types is being addressed by the patch?

A. Virtualization

B. Firmware

C. Application

D. Operating system

A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks.
SIEM alerts have not yet been configured. Which of the following best describes what the security analyst should do to identify this behavior?

A. Digital forensics

B. E-discovery

C. Incident response

D. Threat hunting

Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

A. Disaster recovery plan

B. Incident response procedure

C. Business continuity plan

D. Change management procedure