Which of the following vulnerabilities is associated with installing software outside of a manufacturer’s approved software repository?

A. Jailbreaking

B. Memory injection

C. Resource reuse

D. Side loading

An organization wants to improve the company's security authentication method for remote employees. Given the following requirements:
•	Must work across SaaS and internal network applications
•	Must be device manufacturer agnostic
•	Must have offline capabilities
Which of the following would be the most appropriate authentication method?

A. Username and password

B. Biometrics

C. SMS verification

D. Time-based tokens

An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?

A. Smishing

B. Disinformation

C. Impersonating

D. Whaling

Which of the following is a feature of a next-generation SIEM system?

A. Virus signatures

B. Automated response actions

C. Security agent deployment

D. Vulnerability scanning

A security administrator needs a method to secure data in an environment that includes some form of checks so track any changes. Which of the following should the administrator set up to achieve this goal?

A. SPF

B. GPO

C. NAC

D. FIM

Which of the following is the most likely to be included as an element of communication in a security awareness program?

A. Reporting phishing attempts or other suspicious activities

B. Detecting insider threats using anomalous behavior recognition

C. Verifying information when modifying wire transfer data

D. Performing social engineering as part of third-party penetration testing

During an annual review of the system design, an engineer identified a few issues with the currently released design. Which of the following should be performed next according to best practices?

A. Risk management process

B. Product design process

C. Design review process

D. Change control process

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?

A. Application

B. IPS/IDS

C. Network

D. Endpoint

Which of the following can be used to identify potential attacker activities without affecting production servers?

A. Honeypot

B. Video surveillance

C. Zero Trust

D. Geofencing

A user downloaded software from an online forum. After the user installed the software, the security team observed external network traffic connecting to the user's computer on an uncommon port. Which of the following is the most likely explanation of this unauthorized connection?

A. The software had a hidden keylogger.

B. The software was ransomware.

C. The user’s computer had a fileless virus.

D. The software contained a backdoor.

An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device.
Which of the following best describes the user’s activity?

A. Penetration testing

B. Phishing campaign

C. External audit

D. Insider threat

A company wants to verify that the software the company is deploying came from the vendor the company purchased the software from. Which of the following is the best way for the company to confirm this information?

A. Validate the code signature.

B. Execute the code in a sandbox.

C. Search the executable for ASCII strings.

D. Generate a hash of the files.

A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks.
Which of the following analysis elements did the company most likely use in making this decision?

A. MTTR

B. RTO

C. ARO

D. MTBF

A software development team asked a security administrator to recommend techniques that should be used to reduce the chances of the software being reverse engineered. Which of the following should the security administrator recommend?

A. Digitally signing the software

B. Performing code obfuscation

C. Limiting the use of third-party libraries

D. Using compile flags

Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?

A. Hacktivist

B. Whistleblower

C. Organized crime

D. Unskilled attacker

Which of the following best describes a use case for a DNS sinkhole?

A. Attackers can see a DNS sinkhole as a highly valuable resource to identify a company’s domain structure.

B. A DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.

C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.

D. A DNS sinkhole can be set up to attract potential attackers away from a company’s network resources.

A security administrator would like to protect data on employees’ laptops. Which of the following encryption techniques should the security administrator use?

A. Partition

B. Asymmetric

C. Full disk

D. Database

An accounting clerk sent money to an attacker's bank account after receiving fraudulent instructions to use a new account. Which of the following would most likely prevent this activity in the future?

A. Standardizing security incident reporting

B. Executing regular phishing campaigns

C. Implementing insider threat detection measures

D. Updating processes for sending wire transfers

To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed. Which of the following best describe these types of controls? (Choose two.)

A. Preventive

B. Deterrent

C. Corrective

D. Directive

E. Compensating

F. Detective

A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch jobs locally and does not generate traffic, but the process is now generating outbound traffic over random high ports. Which of the following vulnerabilities has likely been exploited in this software?

A. Memory injection

B. Race condition

C. Side loading

D. SQL injection

Which of the following can best protect against an employee inadvertently installing malware on a company system?

A. Host-based firewall

B. System isolation

C. Least privilege

D. Application allow list

Which of the following incident response activities ensures evidence is properly handled?

A. E-discovery

B. Chain of custody

C. Legal hold

D. Preservation

Which of the following provides the details about the terms of a test with a third-party penetration tester?

A. Rules of engagement

B. Supply chain analysis

C. Right to audit clause

D. Due diligence

Which of the following methods to secure credit card data is best to use when a requirement is to see only the last four numbers on a credit card?

A. Encryption

B. Hashing

C. Masking

D. Tokenization

A security analyst is investigating a workstation that is suspected of outbound communication to a command-and-control server. During the investigation, the analyst discovered that logs on the endpoint were deleted. Which of the following logs would the analyst most likely look at next?

A. IPS

B. Firewall

C. AСL

D. Windows security

A legacy device is being decommissioned and is no longer receiving updates or patches. Which of the following describes this scenario?

A. End of business

B. End of testing

C. End of support

D. End of life

The CIRT is reviewing an incident that involved a human resources recruiter exfiltrating sensitive company data. The CIRT found that the recruiter was able to use HTTP over port 53 to upload documents to a web server. Which of the following security infrastructure devices could have identified and blocked this activity?

A. WAF utilizing SSL decryption

B. NGFW utilizing application inspection

C. UTM utilizing a threat feed

D. SD-WAN utilizing IPSec

Which of the following is best to use when determining the severity of a vulnerability?

A. CVE

B. OSINT

C. SOAR

D. CVSS

The marketing department set up its own project management software without telling the appropriate departments. Which of the following describes this scenario?

A. Shadow IT

B. Insider threat

C. Data exfiltration

D. Service disruption

Which of the following phases of an incident response involves generating reports?

A. Recovery

B. Preparation

C. Lessons learned

D. Containment

After an audit, an administrator discovers all users have access to confidential data on a file server. Which of the following should the administrator use to restrict access to the data quickly?

A. Group Policy

B. Content filtering

C. Data loss prevention

D. Access control lists

A security administrator notices numerous unused, non-compliant desktops are connected to the network. Which of the following actions would the administrator most likely recommend to the management team?

A. Monitoring

B. Decommissioning

C. Patching

D. Isolating

An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofed website. Which of the following should the administrator do?

A. Deploy multifactor authentication.

B. Decrease the level of the web filter settings.

C. Implement security awareness training.

D. Update the acceptable use policy.

Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Choose two.)

A. Fencing

B. Video surveillance

C. Badge access

D. Access control vestibule

E. Sign-in sheet

F. Sensor

Which of the following is required for an organization to properly manage its restore process in the event of system failure?

A. IRP

B. DRP

C. RPO

D. SDLC

Which of the following is used to quantitatively measure the criticality of a vulnerability?

A. CVE

B. CVSS

C. CIA

D. CERT

A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users. Which of the following would be a good use case for this task?

A. Off-the-shelf software

B. Orchestration

C. Baseline

D. Policy enforcement

A user would like to install software and features that are not available with a smartphone's default software. Which of the following would allow the user to install unauthorized software and enable new features?

A. SQLi

B. Cross-site scripting

C. Jailbreaking

D. Side loading

A company is reviewing options to enforce user logins after several account takeovers. The following conditions must be met as part of the solution:
•	Allow employees to work remotely or from assigned offices around the world.
•	Provide a seamless login experience.
•	Limit the amount of equipment required.
Which of the following best meets these conditions?

A. Trusted devices

B. Geotagging

C. Smart cards

D. Time-based logins

A Chief Information Security Officer would like to conduct frequent, detailed reviews of systems and procedures to track compliance objectives. Which of the following will be the best method to achieve this objective?

A. Third-party attestation

B. Penetration testing

C. Internal auditing

D. Vulnerability scans

Which of the following addresses individual rights such as the right to be informed, the right of access, and the right to be forgotten?

A. GDPR

B. PCI DSS

C. NIST

D. ISO

A security analyst scans a company's public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following changes should the security analyst recommend?

A. Changing the remote desktop port to a non-standard number

B. Setting up a VPN and placing the jump server inside the firewall

C. Using a proxy for web connections from the remote desktop server

D. Connecting the remote server to the domain and increasing the password length

Which of the following data roles is responsible for identifying risks and appropriate access to data?

A. Owner

B. Custodian

C. Steward

D. Controller

Which of the following scenarios describes a possible business email compromise attack?

A. An employee receives a gift card request in an email that has an executive’s name in the display field of the email.

B. Employees who open an email attachment receive messages demanding payment in order to access files.

C. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account.

D. An employee receives an email with a link to a phishing site that is designed to look like the company’s email portal.

A network manager wants to protect the company's VPN by implementing multifactor authentication that uses:
Something you know -
Something you have -
Something you are -
Which of the following would accomplish the manager's goal?

A. Domain name, PKI, GeoIP lookup

B. VPN IP address, company ID, facial structure

C. Password, authentication token, thumbprint

D. Company URL, TLS certificate, home address

A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most important for the engineer to consider as part of the planning process? (Choose two.)

A. Key escrow

B. TPM presence

C. Digital signatures

D. Data tokenization

E. Public key management

F. Certificate authority linking

A security team is setting up a new environment for hosting the organization's on-premises software application as a cloud-based service. Which of the following should the team ensure is in place in order for the organization to follow security best practices?

A. Virtualization and isolation of resources

B. Network segmentation

C. Data encryption

D. Strong authentication policies

An organization is building a new backup data center with cost-benefit as the primary requirement and RTO and RPO values around two days. Which of the following types of sites is the best for this scenario?

A. Real-time recovery

B. Hot

C. Cold

D. Warm

A company needs to keep the fewest records possible, meet compliance needs, and ensure destruction of records that are no longer needed. Which of the following best describes the policy that meets these requirements?

A. Security policy

B. Classification policy

C. Retention policy

D. Access control policy

Which of the following teams combines both offensive and defensive testing techniques to protect an organization's critical systems?

A. Red

B. Blue

C. Purple

D. Yellow