fkYqFaLR

1QUESTION 1 Multiple organizations operating in the same vertical want to provide seamless wireless access for their employees as they visit the other organizations. Which of the following should be implemented if all the organizations use the native 802.1x client on their mobile devices?
2A. Shibboleth B. RADIUS federation C. SAML D. OAuth E. OpenlD connect
3Correct Answer: B Section: (none) Explanation
4Explanation/Reference:
5
6
7
8QUESTION 2 Upon entering an incorrect password, the logon screen displays a message informing the user that the password does not match the username provided and is not the required length of 12 characters. Which of the following secure coding techniques should a security analyst address with the application developers to follow security best practices?
9A. Input validation B. Error handling C. Obfuscation D. Data exposure
10Correct Answer: B Section: (none) Explanation
11Explanation/Reference:
12
13
14
15QUESTION 3 A security administrator is developing controls for creating audit trails and tracking if a PHI data breach is to occur. The administrator has been given the following requirements:
16*All access must be correlated to a user account.
17*All user accounts must be assigned to a single individual.
18*User access to the PHI data must be recorded.
19*Anomalies in PHI data access must be reported.
20*Logs and records cannot be deleted or modified.
21Which of the following should the administrator implement to meet the above requirements? (Select THREE).
22A. Eliminate shared accounts. B. Create a standard naming convention for accounts.
23C. Implement usage auditing and review. D. Enable account lockout thresholds. E. Copy logs in real time to a secured WORM drive. F. Implement time-of-day restrictions. G. Perform regular permission audits and reviews.
24Correct Answer: ACE Section: (none) Explanation
25Explanation/Reference:
26
27
28
29
30QUESTION 4 An administrator is replacing a wireless router. The configuration of the old wireless router was not documented before it stopped functioning. The equipment connecting to the wireless network uses older legacy equipment that was manufactured prior to the release of the 802.11i standard. Which of the following configuration options should the administrator select for the new wireless router?
31A. WPA+CCMP B. WPA2+CCMP C. WPA+TKIP D. WPA2+TKIP
32Correct Answer: C Section: (none) Explanation
33Explanation/Reference:
34
35
36
37
38QUESTION 5 Which of the following threat actors is MOST likely to steal a company's proprietary information to gain a market edge and reduce time to market?
39A. Competitor B. Hacktivist C. Insider D. Organized crime
40Correct Answer: A Section: (none) Explanation
41Explanation/Reference:
42QUESTION 6 Which of the following BEST describes an important security advantage yielded by implementing vendor diversity?
43A. Sustainability B. Homogeneity C. Resiliency D. Configurability
44Correct Answer: C Section: (none) Explanation
45Explanation/Reference:
46
47
48
49
50QUESTION 7 Which of the following specifically describes the exploitation of an interactive process to access otherwise restricted areas of the OS?
51A. Pivoting B. Process affinity C. Buffer overflow D. XSS
52Correct Answer: C Section: (none) Explanation
53Explanation/Reference:
54
55
56
57
58QUESTION 8 Which of the following differentiates a collision attack from a rainbow table attack?
59A. A rainbow table attack performs a hash lookup. B. A rainbow table attack uses the hash as a password. C. In a collision attack, the hash and the input data are equivalent. D. In a collision attack, the same input results in different hashes.
60Correct Answer: A Section: (none) Explanation
61Explanation/Reference:
62
63
64
65
66QUESTION 9 A security analyst observes the following events in the logs of an employee workstation:
671/23     1:07:16   865       Access to C:\Users\user\temp\oasdfkh.hta has been restricted by your administrator                                     by the default restriction policy level. 1/23     1:07:09   1034     The scan is completed. No detections were found. 
68The security analyst reviews the file system and observes the following:
69C:\>dir C:\Users\user\temp 1/23  1:07:02      oasdfkh.hta 1/23  1:07:02      update.bat 1/23  1:07:02      msg.txt
70Given the information provided, which of the following MOST likely occurred on the workstation?
71A. Application whitelisting controls blocked an exploit payload from executing. B. Antivirus software found and quarantined three malware files. C. Automatic updates were initiated but failed because they had not been approved. D. The SIEM log aged was not tuned properly and reported a false positive. 
72Correct Answer: A Section: (none) Explanation
73Explanation/Reference:
74
75
76
77
78QUESTION 10 A security technician has been receiving alerts from several servers that indicate load balancers have had a significant increase in traffic. The technician initiates a system scan. The scan results illustrate that the disk space on several servers has reached capacity. The scan also indicates that incoming internet traffic to the servers has increased. Which of the following is the MOST likely cause of the decreased disk space?
79A. Misconfigured devices B. Logs and events anomalies C. Authentication issues D. Unauthorized software
80Correct Answer: D Section: (none) Explanation
81Explanation/Reference:
82
83
84
85
86
87QUESTION 11 A security administrator is diagnosing a server where the CPU utilization is at 100% for 24 hours. The main culprit of CPU utilization is the antivirus program. Which of the following issue could occur if left unresolved? (Select TWO)
88A. MITM attack B. DoS attack C. DLL injection D. Buffer overflow E. Resource exhaustion
89Correct Answer: BE Section: (none) Explanation
90Explanation/Reference:
91QUESTION 12 Which of the following is used to validate the integrity of data?
92A. CBC B. Blowfish C. MD5 D. RSA
93Correct Answer: C Section: (none) Explanation
94Explanation/Reference:
95
96
97
98
99QUESTION 13 A user typically works remotely over the holidays using a web-based VPN to access corporate resources. The user reports getting untrusted host errors and being unable to connect. Which of the following is MOST likely the case?
100A. The certificate has expired B. The browser does not support SSL C. The user's account is locked out D. The VPN software has reached the seat license maximum
101Correct Answer: A Section: (none) Explanation
102Explanation/Reference:
103QUESTION 14 When it comes to cloud computing, if one of the requirements for a project is to have the most control over the systems in the cloud, which of the following is a service model that would be BEST suited for this goal?
104A. Infrastructure B. Platform C. Software D. Virtualization
105Correct Answer: A Section: (none) Explanation
106Explanation/Reference:
107
108
109
110QUESTION 15 A company was recently audited by a third party. The audit revealed the company's network devices were transferring files in the clear. Which of the following protocols should the company use to transfer files?
111A. HTTPS B. LDAPS C. SCP D. SNMPv3
112Correct Answer: C Section: (none) Explanation
113Explanation/Reference:
114
115
116
117
118QUESTION 16 A security analyst is acquiring data from a potential network incident. Which of the following evidence is the analyst MOST likely to obtain to determine the incident?
119A. Volatile memory capture B. Traffic and logs C. Screenshots D. System image capture
120Correct Answer: B Section: (none) Explanation
121Explanation/Reference:
122
123
124
125
126QUESTION 17 A cybersecurity analyst is looking into the payload of a random packet capture file that was selected for analysis. The analyst notices that an internal host had a socket established with another internal host over a non-standard port. Upon investigation, the origin host that initiated the socket shows this output:
127usera@host>history     mkdir /local/usr/bin/somedirectory     nc -1 192.168.5.1 -p 9856     ping -c 30 8.8.8.8 -a 600     rm /etc/dir2/somefile     rm -rm /etc/dir2/     traceroute 8.8.8.8     pakill pid 9487 usera@host>
128Given the above output, which of the following commands would have established the questionable socket?
129A. traceroute 8.8.8.8 B. ping -1 30 8.8.8.8 -a 600 C. nc -1 192.168.5.1 -p 9856 D. pskill pid 9487
130Correct Answer: C Section: (none) Explanation
131Explanation/Reference:
132
133
134
135QUESTION 18 A security administrator has written a script that will automatically upload binary and text-based configuration files onto a remote server using a scheduled task. The configuration files contain sensitive information. Which of the following should the administrator use? (Select TWO)
136A. TOPT B. SCP C. FTP over a non-standard pot D. SRTP E. Certificate-based authentication
137F. SNMPv3
138Correct Answer: BE Section: (none) Explanation
139Explanation/Reference:
140
141
142
143QUESTION 19 A security analyst conducts a manual scan on a known hardened host that identifies many non-compliant items. Which of the following BEST describe why this has occurred? (Select TWO)
144A. Privileged-user certificated were used to scan the host B. Non-applicable plug ins were selected in the scan policy C. The incorrect audit file was used D. The output of the report contains false positives E. The target host has been compromised
145Correct Answer: BC Section: (none) Explanation
146Explanation/Reference:
147
148
149QUESTION 20 Which of the following solutions should an administrator use to reduce the risk from an unknown vulnerability in a third-party software application?
150A. Sandboxing B. Encryption C. Code signing D. Fuzzing
151Correct Answer: A Section: (none) Explanation
152Explanation/Reference:
153
154
155
156QUESTION 21 A network administrator needs to allocate a new network for the R&D group. The network must not be accessible from the Internet regardless of the network firewall or other external misconfigurations. Which of the following settings should the network administrator implement to accomplish this?
157A. Configure the OS default TTL to 1 B. Use NAT on the R&D network C. Implement a router ACL D. Enable protected ports on the switch
158Correct Answer: A Section: (none) Explanation
159Explanation/Reference:
160
161
162
163QUESTION 22 To help prevent one job role from having sufficient access to create, modify, and approve payroll data, which of the following practices should be employed?
164A. Least privilege B. Job rotation C. Background checks D. Separation of duties
165Correct Answer: D Section: (none) Explanation
166Explanation/Reference:
167
168
169
170QUESTION 23 When attackers use a compromised host as a platform for launching attacks deeper into a company's network, it is said that they are:
171A. escalating privilege B. becoming persistent C. fingerprinting D. pivoting
172Correct Answer: D Section: (none) Explanation
173Explanation/Reference:
174
175
176QUESTION 24 The help desk received a call after hours from an employee who was attempting to log into the payroll server remotely. When the help desk returned the call the next morning, the employee was able to log into the server remotely without incident. However, the incident occurred again the next evening. Which of the following BEST describes the cause of the issue?
177A. The password expired on the account and needed to be reset B. The employee does not have the rights needed to access the database remotely C. Time-of-day restrictions prevented the account from logging in D. The employee's account was locked out and needed to be unlocked
178Correct Answer: C Section: (none) Explanation
179Explanation/Reference:
180
181
182
183QUESTION 25 An analyst receives an alert from the SIEM showing an IP address that does not belong to the assigned
184network can be seen sending packets to the wrong gateway. Which of the following network devices is misconfigured and which of the following should be done to remediate the issue?
185A. Firewall; implement an ACL on the interface B. Router; place the correct subnet on the interface C. Switch; modify the access port to trunk port D. Proxy; add the correct transparent interface
186Correct Answer: A Section: (none) Explanation
187Explanation/Reference:
188QUESTION 26 A home invasion occurred recently in which an intruder compromised a home network and accessed a WiFIenabled baby monitor while the baby's parents were sleeping. Which of the following BEST describes how the intruder accessed the monitor?
189A. Outdated antivirus B. WiFi signal strength C. Social engineering D. Default configuration
190Correct Answer: D Section: (none) Explanation
191Explanation/Reference:
192QUESTION 27 A security engineer must install the same x.509 certificate on three different servers. The client application that connects to the server performs a check to ensure the certificate matches the host name. Which of the following should the security engineer use?
193A. Wildcard certificate B. Extended validation certificate C. Certificate chaining D. Certificate utilizing the SAN file
194Correct Answer: D Section: (none) Explanation
195Explanation/Reference: SAN = Subject Alternate Names
196QUESTION 28 Which of the following refers to the term used to restore a system to its operational state?
197A. MTBF B. MTTR C. RTO
198D. RPO
199Correct Answer: B Section: (none) Explanation
200Explanation/Reference:
201QUESTION 29 A Chief Information Officer (CIO) recently saw on the news that a significant security flaws exists with a specific version of a technology the company uses to support many critical application. The CIO wants to know if this reported vulnerability exists in the organization and, if so, to what extent the company could be harmed. Which of the following would BEST provide the needed information?
202A. Penetration test B. Vulnerability scan C. Active reconnaissance D. Patching assessment report
203Correct Answer: A Section: (none) Explanation
204Explanation/Reference:
205QUESTION 30 An organization is expanding its network team. Currently, it has local accounts on all network devices, but with growth, it wants to move to centrally managed authentication. Which of the following are the BEST solutions for the organization? (Sect TWO)
206A. TACACS+ B. CHAP C. LDAP D. RADIUS E. MSCHAPv2
207Correct Answer: AD Section: (none) Explanation
208Explanation/Reference:
209QUESTION 31 An active/passive configuration has an impact on:
210A. confidentiality B. integrity C. availability D. non-repudiation
211Correct Answer: C Section: (none)
212Explanation
213Explanation/Reference:
214QUESTION 32 Which of the following attack types BEST describes a client-side attack that is used to manipulate an HTML iframe with JavaScript code via a web browser?
215A. Buffer overflow B. MITM C. XSS D. SQLi
216Correct Answer: C Section: (none) Explanation
217Explanation/Reference:
218QUESTION 33 Which of the following would provide additional security by adding another factor to a smart card?
219A. Token B. Proximity badge C. Physical key D. PIN
220Correct Answer: D Section: (none) Explanation
221Explanation/Reference:
222QUESTION 34 A security analyst receives an alert from a WAF with the following payload:
223var data = "<test test test> ++ <../../../../../../etc/passwd>"
224Which of the following types of attacks is this?
225A. Cross-site request forgery B. Buffer overflow C. SQL injection D. JavaScript data insertion E. Firewall evasion script
226Correct Answer: C Section: (none) Explanation
227Explanation/Reference:
228QUESTION 35 Which of the following uses precomputed hashes to guess passwords?
229A. Iptables B. NAT tables C. Rainbow tables D. ARP tables
230Correct Answer: C Section: (none) Explanation
231Explanation/Reference:
232QUESTION 36 A systems administrator wants to provide balance between the security of a wireless network and usability. The administrator is concerned with wireless encryption compatibility of older devices used by some employees. Which of the following would provide strong security backward compatibility when accessing the wireless network?
233A. Open wireless network and SSL VPN B. WPA using a preshared key C. WAP2 using a RADIUS back-end for 802.1x authentication D. WEP with a 40-bit key
234Correct Answer: A Section: (none) Explanation
235Explanation/Reference:
236QUESTION 37 In determining when it may be necessary to perform a credentialed scan against a system instead of a noncredentialed scan, which of the following requirements is MOST likely to influence its decisions?
237A. The scanner must be able to enumerate the host OS of devices scanner B. The scanner must be able to footprint the network C. The scanner must be able to check for open ports with listening services D. The scanner must be able to audit file system permissions
238Correct Answer: D Section: (none) Explanation
239Explanation/Reference:
240QUESTION 38 A security administrator receives an alert from a third-party vendor that indicates a certificate that was installed in the browser has been hijacked at the root of a small public CA. The security administrator knows there are at least four different browsers in use on more than a thousand computers in the domain worldwide. Which of the following solutions would be BEST for the security administrator to implement to most efficiently assist with this issue?
241A. SSL B. CRL C. PKI D. ACL
242Correct Answer: B Section: (none) Explanation
243Explanation/Reference:
244QUESTION 39 After a user reports slow computer performance, a systems administrator detects a suspicious file, which was installed as part of a freeware software package. The systems administrator reviews the output below:
245c:\Windows\system32>netstat -nab Active Connections Pronto     Local Address      Foreign Address      State TCP        0.0.0.0:135        0.0.0.0              RpcSs [svchoat.exe] TCP        0.0.0.0:445        0.0.0.0              [svchost.exe] TCP        192.168.1.10:5000  10.37.213.20         winserver.exe UDP        192.168.1.10:1900  *.*                  SSDPSVR
246Based on the above information, which of the following types of malware was installed on the user's computer?
247A. RAT B. Keylogger C. Spyware D. Worm E. Bot
248Correct Answer: A Section: (none) Explanation
249Explanation/Reference:
250QUESTION 40 A company has noticed multiple instances of proprietary information on public websites. It has also observed an increase in the number of email messages sent to random employees containing malicious links and PDFs. Which of the following changes should the company make to reduce the risks associated with phishing attacks? (Select TWO)
251A. Install an additional firewall B. Implement a redundant email server C. Block access to personal email on corporate systems D. Update the X.509 certificates on the corporate email server E. Update corporate policy to prohibit access to social media websites F. Review access violation on the file server
252Correct Answer: CE Section: (none) Explanation
253Explanation/Reference:
254QUESTION 41 A security analyst is investigating a potential reach. Upon gathering, documenting, and securing the evidence, which of the following actions is the NEXT step to minimize the business impact?
255A. Launch an investigation to identify the attacking host B. Initiate the incident response plan C. Review lessons learned captured in the process D. Remove malware and restore the system to normal operation
256Correct Answer: D Section: (none) Explanation
257Explanation/Reference:
258QUESTION 42 Joe, a salesman, was assigned to a new project that requires him to travel to a client site. While waiting for a flight, Joe, decides to connect to the airport wireless network without connecting to a VPN,and the sends confidential emails to fellow colleagues. A few days later, the company experiences a data breach. Upon investigation, the company learns Joe's emails were intercepted. Which of the following MOST likely caused the data breach?
259A. Policy violation B. Social engineering C. Insider threat D. Zero-day attack
260Correct Answer: A Section: (none) Explanation
261Explanation/Reference:
262QUESTION 43 An information security specialist is reviewing the following output from a Linux server:
263user@server:~$ -l 5 * * * * /usr/local/bin.backup.sh user@server:~$ cat /usr/local/bin/backup.sh #!/bin/bash if ! grep --quiet joeuser /etc/passwd the rm -rf / fi
264Based on the above information, which of the following types of malware was installed on the server?
265A. Logic bomb B. Trojan C. Backdoor D. Ransomware E. Rootkit
266Correct Answer: A Section: (none) Explanation
267Explanation/Reference:
268QUESTION 44 A company wants to ensure confidential data from storage media is sanitized in such a way that the drive cannot be reused. Which of the following method should the technician use?
269A. Shredding B. Wiping C. Low-level formatting D. Repartitioning E. Overwriting
270Correct Answer: A Section: (none) Explanation
271Explanation/Reference:
272QUESTION 45 A forensic expert is given a hard drive from a crime scene and is asked to perform an investigation. Which of the following is the FIRST step the forensic expert needs to take the chain of custody?
273A. Make a forensic copy B. Create a hash of the hard rive C. Recover the hard drive data D. Update the evidence log
274Correct Answer: D Section: (none) Explanation
275Explanation/Reference:
276QUESTION 46 An incident response manager has started to gather all the facts related to a SIEM alert showing multiple systems may have been compromised. The manager has gathered these facts:
277The breach is currently indicated on six user PCs One service account is potentially compromised Executive management has been notified
278In which of the following phases of the IRP is the manager currently working?
279A. Recovery B. Eradication C. Containment D. Identification
280Correct Answer: D Section: (none) Explanation
281Explanation/Reference:
282QUESTION 47 A stock trading company had the budget for enhancing its secondary datacenter approved. Since the main site is a hurricane-affected area and the disaster recovery site is 100 mi (161 km) away, the company wants to ensure its business is always operational with the least amount of man hours needed. Which of the following types of disaster recovery sites should the company implement?
283A. Hot site B. Warm site C. Cold site D. Cloud-based site
284Correct Answer: D Section: (none) Explanation
285Explanation/Reference:
286QUESTION 48 A systems administrator is attempting to recover from a catastrophic failure in the datacenter. To recover the domain controller, the systems administrator needs to provide the domain administrator credentials. Which of the following account types is the system administrator using?
287A. Shared accounts B. Guest account C. Service account D. User account
288Correct Answer: D Section: (none) Explanation
289Explanation/Reference:
290QUESTION 49 User from two organizations, each with its own PKI, need to begin working together on a joint project. Which of the following would allow the users of the separate PKIs to work together without connection errors?
291A. Trust model B. Stapling C. Intermediate CA D. Key escrow
292Correct Answer: A Section: (none) Explanation
293Explanation/Reference:
294QUESTION 50 A security analyst is migrating a pass-the-hash vulnerability on a Windows infrastructure. Given the requirement, which of the following should the security analyst do to MINIMIZE the risk?
295A. Enable CHAP B. Disable NTLM C. Enable Kerebos D. Disable PAP
296Correct Answer: B Section: (none) Explanation
297Explanation/Reference:
298QUESTION 51 An organization requires users to provide their fingerprints to access an application. To improve security, the application developers intend to implement multifactor authentication. Which of the following should be implemented?
299A. Use a camera for facial recognition B. Have users sign their name naturally C. Require a palm geometry scan D. Implement iris recognition
300Correct Answer: B Section: (none) Explanation
301Explanation/Reference:
302QUESTION 52 A security analyst is reviewing an assessment report that includes software versions, running services, supported encryption algorithms, and permission settings. Which of the following produced the report?
303A. Vulnerability scanner B. Protocol analyzer C. Network mapper D. Web inspector
304Correct Answer: A Section: (none) Explanation
305Explanation/Reference:
306QUESTION 53 A Chief Information Officer (CIO) asks the company's security specialist if the company should spend any funds on malware protection for a specific server. Based on a risk assessment, the ARO value of a malware infection for a server is 5 and the annual cost for the malware protection is $2500. Which of the following SLE values warrants a recommendation against purchasing the malware protection?
307A. $500 B. $1000 C. $2000 D. $2500
308Correct Answer: A Section: (none) Explanation
309Explanation/Reference:
310QUESTION 54 The computer resource center issue smartphones to all first-level and above managers. The managers have the ability to install mobile tools. Which of the following tools should be implemented with the type of tools the managers installed?
311A. Download manager B. Content manager C. Segmentation manager D. Application manager
312Correct Answer: D Section: (none) Explanation
313Explanation/Reference:
314QUESTION 55 A systems administrator wants to provide for and enforce wireless access accountability during events where external speakers are invited to make presentations to a mixed audience of employees and non-employees. Which of the following should the administrator implement?
315A. Shared accounts B. Preshared passwords C. Least privilege D. Sponsored guest
316Correct Answer: D Section: (none) Explanation
317Explanation/Reference:
318QUESTION 56 A recent internal audit is forcing a company to review each internal business unit's VMs because the cluster they are installed on is in danger of running out of computer resources. Which of the following vulnerabilities exist?
319A. Buffer overflow B. End-of-life systems C. System sprawl
320D. Weak configuration
321Correct Answer: C Section: (none) Explanation
322Explanation/Reference:
323QUESTION 57 A security administrator has found a hash in the environment known to belong to malware. The administrator then finds this file to be in the preupdate area of the OS, which indicated it was pushed from the central patch system.
324      File: winx86_adobe_upgrade.exe   Hash: 99ac28bede43ab869b853ba62c4ea243
325Administrator pulls a report from the patch management system with the following output:   
326Install Date  Package Name              Target Device  Hash 10/10/2017      java_11.2_x64.exe             HQ PC's          01ab28bbde63aa879b35bba62cdea282 10/10/2017    winx86_adobe_flash_upgrade.exe  HQ PC's          99ac28bede43ab86b853ba62c4ea243 Given the above output, which of the following MOST likely happened?
327A. The file was corrupted after it left the patch system B. The file was infected when the patch manager downloaded it C. The file was not approved in the application whitelist system D. The file was embedded with a logic bomb to evade detection
328Correct Answer: B Section: (none) Explanation
329Explanation/Reference:
330QUESTION 58 Two users must encrypt and transmit large amounts of data between them. Which of the following should they use to encrypt and transmit the data?
331A. Symmetric algorithm B. Hash function C. Digital signature D. Obfuscation
332Correct Answer: A Section: (none) Explanation
333Explanation/Reference:
334QUESTION 59 A new Chief Information Officer (CIO) has been reviewing the badging and decides to write a policy that all employees must have their badges rekeyed at least annually. Which of the following controls BEST describes this policy?
335A. Physical B. Corrective C. Technical D. Administrative
336Correct Answer: D Section: (none) Explanation
337Explanation/Reference:
338QUESTION 60 A software developer is concerned about DLL hijacking in an application being written. Which of the following is the MOST viable mitigation measure of this type of attack?
339A. The DLL of each application should be set individually B. All calls to different DLLs should be hard-coded in the application C. Access to DLLs from the Windows registry should be disabled D. The affected DLLs should be renamed to avoid future hijacking
340Correct Answer: B Section: (none) Explanation
341Explanation/Reference:
342QUESTION 61 A security engineer wants to implement a site-to-site VPN that will require SSL certificates for mutual authentication. Which of the following should the engineer implement if the design requires client MAC addresses to be visible across the tunnel?
343A. Tunnel mode IPSec B. Transport mode VPN IPSec C. L2TP D. SSL VPN
344Correct Answer: D Section: (none) Explanation
345Explanation/Reference:
346QUESTION 62 An application was recently compromised after some malformed data came in via web form. Which of the following would MOST likely have prevented this?
347A. Input validation B. Proxy server C. Stress testing D. Encoding
348Correct Answer: A
349Section: (none) Explanation
350Explanation/Reference:
351QUESTION 63 While working on an incident, Joe, a technician, finished restoring the OS and applications on a workstation from the original media. Joe is about to begin copying the user's files back onto the hard drive. Which of the following incident response steps is Joe working on now?
352A. Recovery B. Eradication C. Containment D. Identification
353Correct Answer: A Section: (none) Explanation
354Explanation/Reference:
355QUESTION 64 A systems administrator found a suspicious file in the root of the file system. The file contains URLs, usernames, passwords, and text from other documents being edited on the system. Which of the following types of malware would generate such a file?
356A. Keylogger B. Rootkit C. Bot D. RAT
357Correct Answer: A Section: (none) Explanation
358Explanation/Reference:
359QUESTION 65 A computer emergency response team is called at midnight to investigate a case in which a mail server was restarted. After an initial investigation, it was discovered that email is being exfiltrated through an active connection. Which of the following is the NEXT step the team should take?
360A. Identify the source of the active connection B. Perform eradication of active connection and recover C. Performance containment procedure by disconnecting the server D. Format the server and restore its initial configuration
361Correct Answer: A Section: (none) Explanation
362Explanation/Reference:
363QUESTION 66 A remote intruder wants to take inventory of a network so exploits can be researched. The intruder is looking for information about software versions on the network. Which of the following techniques is the intruder using?
364A. Banner grabbing B. Port scanning C. Packet sniffing D. Virus scanning
365Correct Answer: A Section: (none) Explanation
366Explanation/Reference:
367QUESTION 67 An analyst is reviewing a simple program for potential security vulnerabilities before being deployed to a Windows server. Given the following code:
368void foo (char *bar) {     car random_user_input[12];     stropy (random_user_input, bar); }
369Which of the following vulnerabilities is present?
370A. Bad memory pointer B. Buffer overflow C. Integer overflow D. Backdoor
371Correct Answer: B Section: (none) Explanation
372Explanation/Reference:
373QUESTION 68 A company has a data classification system with definitions for "Private" and "Public". the company's security policy outlines how data should be protected based on type. The company recently added data type "Proprietary". Which of the following is the MOST likely reason the company added this data type?
374A. Reduced cost B. More searchable data C. Better data classification D. Expanded authority of the privacy officer
375Correct Answer: C Section: (none) Explanation
376Explanation/Reference:
377QUESTION 69 A security technician is configuring an access management system to track and record user actions. Which of the following functions should the technician configure?
378A. Accounting B. Authorization C. Authentication D. Identification
379Correct Answer: A Section: (none) Explanation
380Explanation/Reference:
381QUESTION 70 A security administrator installed a new network scanner that identifies new host systems on the network. Which of the following did the security administrator install?
382A. Vulnerability scanner B. Network-based IDS C. Rogue system detection D. Configuration compliance scanner
383Correct Answer: C Section: (none) Explanation
384Explanation/Reference:
385QUESTION 71 A Chief Information Officer (CIO) has decided it is not cost effective to implement safeguards against a known vulnerability. Which of the following risk responses does this BEST describe?
386A. Transference B. Avoidance C. Mitigation D. Acceptance
387Correct Answer: D Section: (none) Explanation
388Explanation/Reference:
389QUESTION 72 An audit takes place after company-wide restructuring, in which several employees changed roles. The following deficiencies are found during the audit regarding access to confidential data.
390Employee    Job Function         Audit Finding
391Ann             Sales Manager     *Access to confidential payroll shares                                              *Access to payroll processing program                                              *Access to marketing shares
392Jeff             Marketing Director  *Access to human resources annual review folder                                              *Access to shared human resources mailbox
393John           Sales Manager       *Active account                                               *Access to human resources annual review folder                                               *Access to confidential payroll shares
394Which of the following would be the BEST method to prevent similar audit finding in the future?
395A. Implement separation of duties for the payroll department B. Implement a DLP solution on the payroll and human resources reviews C. Implement rule-based access controls on the human resources server D. Implement regular permission auditing and reviews
396Correct Answer: D Section: (none) Explanation
397Explanation/Reference:
398QUESTION 73 A technician is investigating a potentially compromised device with the following symptoms:
399Browser slowness Frequent browser crashes Hourglass stuck New search toolbar Increased memory consumption
400Which of the following types of malware has infected the system?
401A. Man-in-the-browser B. Spoofer C. Spyware D. Adware
402Correct Answer: A Section: (none) Explanation
403Explanation/Reference:
404QUESTION 74 A penetration tester has written an application that performs a bit-by-bit XOR 0xFF operation on binaries prior to transmission over untrusted media. Which of the following BEST describes the action performed by this type of application?
405A. Hashing B. Key exchange C. Encryption
406D. Obfusication
407Correct Answer: D Section: (none) Explanation
408Explanation/Reference:
409QUESTION 75 An audit reported has identifies a weakness that could allow unauthorized personnel access to the facility at its main entrance and from there gain access to the network. Which of the following would BEST resolve the vulnerability?
410A. Faraday cage B. Air gap C. Mantrap D. Bollards
411Correct Answer: C Section: (none) Explanation
412Explanation/Reference:
413QUESTION 76 When attempting to secure a mobile workstation, which of the following authentication technologies rely on the user's physical characteristics? (Select TWO)
414A. MAC address table B. Retina scan C. Fingerprint scan D. Two-factor authentication E. CAPTCHA F. Password string
415Correct Answer: BC Section: (none) Explanation
416Explanation/Reference:
417QUESTION 77 Systems administrator and key support staff come together to simulate a hypothetical interruption of service. The team updates the disaster recovery processes and documentation after meeting. Which of the following describes the team's efforts?
418A. Business impact analysis B. Continuity of operation C. Tabletop exercise D. Order of restoration
419Correct Answer: C
420Section: (none) Explanation
421Explanation/Reference:
422QUESTION 78 A company has two wireless networks utilizing captive portals. Some employees report getting a trust error in their browsers when connecting to one of the networks. Both captive portals are using the same server certificate for authentication, but the analyst notices the following differences between the two certificate details:
423Certificate 1 Certificate Path: Geotrust Global CA                                  *company.com
424Certificate 2 Certificate Path: *company.com
425Which of the following would resolve the problem?
426A. Use a wildcard certificate. B. Use certificate chaining. C. Use a trust model. D. Use an extended validation certificate.
427Correct Answer: B Section: (none) Explanation
428Explanation/Reference:
429QUESTION 79 Company A has acquired Company B. Company A has different domains spread globally, and typically migrates its acquisitions infrastructure under its own domain infrastructure. Company B, however, cannot be merged into Company A's domain infrastructure. Which of the following methods would allow the two companies to access one another's resources?
430A. Attestation B. Federation C. Single sign-on D. Kerberos
431Correct Answer: B Section: (none) Explanation
432Explanation/Reference:
433QUESTION 80 A technician is configuring a load balancer for the application team to accelerate the network performance of their applications. The applications are hosted on multiple servers and must be redundant. Given this scenario, which of the following would be the BEST method of configuring the load balancer?
434A. Round-robin B. Weighted C. Least connection D. Locality-based
435Correct Answer: D Section: (none) Explanation
436Explanation/Reference:
437QUESTION 81 Ann is the IS manager for several new systems in which the classifications of the systems' data are being decided. She is trying to determine the sensitivity level of the data being processed. Which of the following people should she consult to determine the data classification?
438A. Steward B. Custodian C. User D. Owner
439Correct Answer: D Section: (none) Explanation
440Explanation/Reference:
441QUESTION 82 An organization's employees currently use three different sets of credentials to access multiple internal resources. Management wants to make this process less complex. Which of the following would be the BEST option to meet this goal?
442A. Transitive trust B. Single sign-on C. Federation D. Secure token
443Correct Answer: B Section: (none) Explanation
444Explanation/Reference:
445QUESTION 83 An external attacker can modify the ARP cache of an internal computer. Which of the following types of attacks is described?
446A. Replay B. Spoofing C. DNS poisoning D. Client-side attack
447Correct Answer: B Section: (none) Explanation
448Explanation/Reference:
449QUESTION 84 A systems administrator has isolated an infected system from the network and terminated the malicious process from executing. Which of the following should the administrator do NEXT according to the incident response process?
450A. Restore lost data from a backup. B. Wipe the system. C. Document the lessons learned. D. Determine the scope of impact.
451Correct Answer: A Section: (none) Explanation
452Explanation/Reference:
453QUESTION 85 A new security administrator ran a vulnerability scanner for the first time and caused a system outage. Which of the following types of scans MOST likely caused the outage?
454A. Non-intrusive credentialed scan B. Non-intrusive non-credentialed scan C. Intrusive credentialed scan D. Intrusive non-credentialed scan
455Correct Answer: D Section: (none) Explanation
456Explanation/Reference:
457QUESTION 86 A security analyst is hardening a WiFi infrastructure. The primary requirements are the following:
458The infrastructure must allow staff to authenticate using the most secure method. The infrastructure must allow guests to use an "open" WiFi network that logs valid email addresses before granting access to the Internet.
459Given these requirements, which of the following statements BEST represents what the analyst should recommend and configure?
460A. Configure a captive portal for guests and WPS for staff. B. Configure a captive portal for staff and WPA for guests. C. Configure a captive portal for staff and WEP for guests. D. Configure a captive portal for guest and WPA2 Enterprise for staff. 
461Correct Answer: D
462Section: (none) Explanation
463Explanation/Reference:
464QUESTION 87 A security administrator is trying to eradicate a worm, which is spreading throughout the organization, using an old remote vulnerability in the SMB protocol. The worm uses Nmap to identify target hosts within the company. The administrator wants to implement a solution that will eradicate the current worm and any future attacks that may be using zero-day vulnerabilities. Which of the following would BEST meet the requirements when implemented?
465A. Host-based firewall B. Enterprise patch management system C. Network-based intrusion prevention system D. Application blacklisting E. File integrity checking
466Correct Answer: C Section: (none) Explanation
467Explanation/Reference:
468QUESTION 88 Which of the following is a deployment concept that can be used to ensure only the required OS access is exposed to software applications?
469A. Staging environment B. Sandboxing C. Secure baseline D. Trusted OS
470Correct Answer: B Section: (none) Explanation
471Explanation/Reference:
472QUESTION 89 A procedure differs from a policy in that it:
473A. is a high-level statement regarding the company's position on a topic. B. sets a minimum expected baseline of behavior. C. provides step-by-step instructions for performing a task. D. describes adverse actions when violations occur.
474Correct Answer: C Section: (none) Explanation
475Explanation/Reference:
476QUESTION 90 Ann, a user, reports she is unable to access an application from her desktop. A security analyst verifies Ann's access and checks the SIEM for any errors. The security analyst reviews the log file from Ann's system and notices the following output:
4772017--08-21  10:48:12  DROP  TCP  172.20.89.232  239.255.255.255  443  1900  250 -------- RECEIVE 2017--08-21  10:48:12  DROP  UDP  192.168.72.205  239.255.255.255  443  1900  250 -------- RECEIVE
478Which of the following is MOST likely preventing Ann from accessing the application from the desktop?
479A. Web application firewall B. DLP C. Host-based firewall D. UTM E. Network-based firewall
480Correct Answer: B Section: (none) Explanation
481Explanation/Reference: Webmail is being blocked. The 250 response code is for SMTP.
482QUESTION 91 Which of the following types of penetration test will allow the tester to have access only to password hashes prior to the penetration test?
483A. Black box B. Gray box C. Credentialed D. White box
484Correct Answer: B Section: (none) Explanation
485Explanation/Reference:
486QUESTION 92 Which of the following threats has sufficient knowledge to cause the MOST danger to an organization?
487A. Competitors B. Insiders C. Hacktivists D. Script kiddies
488Correct Answer: B Section: (none) Explanation
489Explanation/Reference:
490QUESTION 93
491While troubleshooting a client application connecting to the network, the security administrator notices the following error: Certificate is not valid. Which of the following is the BEST way to check if the digital certificate is valid?
492A. PKI B. CRL C. CSR D. IPSec
493Correct Answer: B Section: (none) Explanation
494Explanation/Reference:
495QUESTION 94 To determine the ALE of a particular risk, which of the following must be calculated? (Select TWO).
496A. ARO B. ROI C. RPO D. SLE E. RTO
497Correct Answer: AD Section: (none) Explanation
498Explanation/Reference:
499QUESTION 95 A business sector is highly competitive, and safeguarding trade secrets and critical information is paramount. On a seasonal basis, an organization employs temporary hires and contractor personnel to accomplish its mission objectives. The temporary and contract personnel require access to network resources only when on the clock. Which of the following account management practices are the BEST ways to manage these accounts?
500A. Employ time-of-day restrictions. B. Employ password complexity. C. Employ a random key generator strategy. D. Employ an account expiration strategy. E. Employ a password lockout policy. 
501Correct Answer: D Section: (none) Explanation
502Explanation/Reference:
503QUESTION 96 Which of the following locations contain the MOST volatile data?
504A. SSD B. Paging file C. RAM D. Cache memory
505Correct Answer: D Section: (none) Explanation
506Explanation/Reference:
507QUESTION 97 Ann, a customer, is reporting that several important files are missing from her workstation. She recently received communication from an unknown party who is requesting funds to restore the files. Which of the following attacks has occurred?
508A. Ransomware B. Keylogger C. Buffer overflow D. Rootkit
509Correct Answer: A Section: (none) Explanation
510Explanation/Reference:
511QUESTION 98 Every morning, a systems administrator monitors failed login attempts on the company's log management server. The administrator notices the DBAdmin account has five failed username and/or password alerts during a ten-minute window. The systems administrator determines the user account is a dummy account used to attract attackers. Which of the following techniques should the systems administrator implement?
512A. Role-based access control B. Honeypot C. Rule-based access control D. Password cracker
513Correct Answer: B Section: (none) Explanation
514Explanation/Reference:
515QUESTION 99 Joe, a user, has been trying to send Ann, a different user, an encrypted document via email. Ann has not received the attachment but is able to receive the header information. Which of the following is MOST likely preventing Ann from receiving the encrypted file?
516A. Unencrypted credentials B. Authentication issues C. Weak cipher suite
517D. Permission issues
518Correct Answer: B Section: (none) Explanation
519Explanation/Reference:
520QUESTION 100 A systems administrator is configuring a system that uses data classification labels. Which of the following will the administrator need to implement to enforce access control?
521A. Discretionary access control B. Mandatory access control C. Role-based access control D. Rule-based access control
522Correct Answer: B Section: (none) Explanation
523Explanation/Reference:
524QUESTION 101 An analyst is using a vulnerability scanner to look for common security misconfigurations on devices. Which of the following might be identified by the scanner? (Select TWO).
525A. The firewall is disabled on workstations. B. SSH is enabled on servers. C. Browser homepages have not been customized. D. Default administrator credentials exist on networking hardware. E. The OS is only set to check for updates once a day.
526Correct Answer: AD Section: (none) Explanation
527Explanation/Reference:
528QUESTION 102 A security analyst is reviewing patches on servers. One of the servers is reporting the following error message in the WSUS management console:
529The computer has not reported status in 30 days.
530Given this scenario, which of the following statements BEST represents the issue with the output above?
531A. The computer in question has not pulled the latest ACL policies for the firewall. B. The computer in question has not pulled the latest GPO policies from the management server. C. The computer in question has not pulled the latest antivirus definitions from the antivirus program. D. The computer in question has not pulled the latest application software updates.
532Correct Answer: D
533Section: (none) Explanation
534Explanation/Reference:
535QUESTION 103 Two users must encrypt and transmit large amount of data between them. Which of the following should they use to encrypt and transmit the data?
536A. Symmetric algorithm B. Hash function C. Digital signature D. Obfuscation
537Correct Answer: A Section: (none) Explanation
538Explanation/Reference:
539QUESTION 104 A security administrator is reviewing the following PowerShell script referenced in the Task Scheduler on a database server:
540$members = GetADGroupMemeber -Identity "Domain Admins" -Recursive | Select ExpandProperty name if ($members -notcontains "JohnDoe"){         Remove-Item -path C:\Database -recurse -force } Which of the following did the security administrator discover?
541A. Ransomeware B. Backdoor C. Logic bomb D. Trojan
542Correct Answer: C Section: (none) Explanation
543Explanation/Reference:
544QUESTION 105 A bank is experiencing a DoS attack against an application designed to handle 500IP-based sessions. in addition, the perimeter router can only handle 1Gbps of traffic. Which of the following should be implemented to prevent a DoS attacks in the future?
545A. Deploy multiple web servers and implement a load balancer B. Increase the capacity of the perimeter router to 10 Gbps C. Install a firewall at the network to prevent all attacks D. Use redundancy across all network devices and services
546Correct Answer: D
547Section: (none) Explanation
548Explanation/Reference:
549QUESTION 106 A malicious system continuously sends an extremely large number of SYN packets to a server. Which of the following BEST describes the resulting effect?
550A. The server will be unable to server clients due to lack of bandwidth B. the server's firewall will be unable to effectively filter traffic due to the amount of data transmitted C. The server will crash when trying to reassemble all the fragmented packets D. The server will exhaust its memory maintaining half-open connections
551Correct Answer: D Section: (none) Explanation
552Explanation/Reference:
553QUESTION 107 A systems administrator is deploying a new mission essential server into a virtual environment. Which of the following is BEST mitigated by the environment's rapid elasticity characteristic?
554A. Data confidentiality breaches B. VM escape attacks C. Lack of redundancy D. Denial of service
555Correct Answer: D Section: (none) Explanation
556Explanation/Reference:
557QUESTION 108 Which of the following is the proper order for logging a user into a system from the first step to the last step?
558A. Identification, authentication, authorization B. Identification, authorization, authentication C. Authentication, identification, authorization D. Authentication, identification, authorization E. Authorization, identification, authentication
559Correct Answer: A Section: (none) Explanation
560Explanation/Reference:
561QUESTION 109 A company stores highly sensitive data files used by the accounting system on a server file share. The
562accounting system uses a service account named accounting-svc to access the file share. The data is protected will a full disk encryption, and the permissions are set as follows:
563File system permissions: Users = Read Only Share permission: accounting-svc = Read Only
564Given the listed protections are in place and unchanged, to which of the following risks is the data still subject?
565A. Exploitation of local console access and removal of data B. Theft of physical hard drives and a breach of confidentiality C. Remote exfiltration of data using domain credentials D. Disclosure of sensitive data to third parties due to excessive share permissions
566Correct Answer: A Section: (none) Explanation
567Explanation/Reference:
568QUESTION 110 A bank uses a wireless network to transmit credit card purchases to a billing system. Which of the following would be MOST appropriate to protect credit card information from being accessed by unauthorized individuals outside of the premises?
569A. Air gap B. Infrared detection C. Faraday cage D. Protected distributions
570Correct Answer: C Section: (none) Explanation
571Explanation/Reference:
572QUESTION 111 Joe, a salesman, was assigned to a new project that requires him to travel to a client site. While waiting for a flight, Joe decides to connect to the airport wireless network without connecting to a VPN, and then sends confidential emails to fellow colleagues. A few days later, the company experiences a data breach. Upon investigation, the company learns Joe's emails were intercepted. Which of the following MOST likely caused the data breach?
573A. Policy violation B. Social engineering C. Insider threat D. Zero--day attack
574Correct Answer: A Section: (none) Explanation
575Explanation/Reference:
576QUESTION 112 A help desk technician receives a phone call from an individual claiming to be an employee of the organization and requesting assistance to access a locked account. The help desk technician asks the individual to provide proof of identity before access can be granted. Which of the following types of attack is the caller performing?
577A. Phishing B. Shoulder surfing C. Impersonation D. Dumpster diving
578Correct Answer: C Section: (none) Explanation
579Explanation/Reference:
580QUESTION 113 Confidential emails from an organization were posted to a website without the organization's knowledge. Upon investigation, it was determined that the emails were obtained from an internal actor who sniffed the emails in plain text. Which of the following protocols, if properly implemented, would have MOST likely prevented the emails from being sniffed? (Select TWO)
581A. Secure IMAP B. DNSSEC C. S/MIME D. SMTPS E. HTTPS
582Correct Answer: CD Section: (none) Explanation
583Explanation/Reference: SMTPS (Simple Mail Transfer Protocol Secure) is a deprecated method for securing SMTP with transport layer security. It is intended to provide authentication of the communication partners, as well as data integrity and confidentiality.
584SMTPS is not a proprietary protocol and not an extension of SMTP. It is just a way to secure SMTP at the transport layer. SMTPS uses port 465.
585QUESTION 114 A company wants to implement an access management solution that allows employees to use the same usernames and passwords for multiple applications without having to keep multiple credentials synchronized. Which of the following solutions would BEST meet these requirements?
586A. Multifactor authentication B. SSO C. Biometrics D. PKI E. Federation
587Correct Answer: BE Section: (none) Explanation
588Explanation/Reference:
589QUESTION 115 An external auditor visits the human resources department and performs a physical security assessment. The auditor observed documents on printers that are unclaimed. A closer look at these documents reveals employee names, addresses, ages, and types of medical and dental coverage options each employee has selected. Which of the following is the MOST appropriate actions to take?
590A. Flip the documents face down so no one knows these documents are PII sensitive B. Shred the documents and let the owner print the new set C. Retrieve the documents, label them with a PII cover sheet, and return them to the printer D. Report to the human resources manager that their personnel are violating a privacy policy
591Correct Answer: D Section: (none) Explanation
592Explanation/Reference:
593QUESTION 116 Which of the following authentication concepts is a gait analysis MOST closely associated?
594A. Somewhere you are B. Something you are C. Something you do D. Something you know
595Correct Answer: C Section: (none) Explanation
596Explanation/Reference:
597QUESTION 117 Which of the following metrics are used to calculate the SLE? (Select TWO)
598A. ROI B. ARO C. ALE D. MTBF E. MTTF F. TCO
599Correct Answer: BC Section: (none) Explanation
600Explanation/Reference:
601QUESTION 118 Due to regulatory requirements, server in a global organization must use time synchronization. Which of the following represents the MOST secure method of time synchronization?
602A. The server should connect to external Stratum 0 NTP servers for synchronization B. The server should connect to internal Stratum 0 NTP servers for synchronization C. The server should connect to external Stratum 1 NTP servers for synchronization D. The server should connect to external Stratum 1 NTP servers for synchronization
603Correct Answer: B Section: (none) Explanation
604Explanation/Reference: Configure your own Internal NTP hierarchical service for your network. It is possible to purchase Stratum 1 or Stratum 0 NTP appliances to use internally for less than the cost of a typical server. It is also possible to set up a private NTP server at a very low cost. The feasibility of setting up a commercial off the shelf (COTS) NTP server is evidenced in a recent effort to configure a Raspberry Pi computer as a Stratum-1 server. If you do decide to configure you own, please consider the following best practices:
605Standardize to UTC time. Within an enterprise, standardize all systems to coordinated universal time (UTC). Standardizing to UTC simplifies log correlation within the organization and with external parties no matter what time zone the device being synchronized is located in. 
606Securing the network time service. Restrict the commands that can be used on the stratum servers. Do not allow public queries of the stratum servers. Only allow known networks/hosts to communicate with their respective stratum servers. 
607Consider the business need for cryptography. Many administrators try to secure their networks with encrypted communications and encrypted authentication. I would introduce a note of caution here because although there are cryptographic services associated with NTP for securing NTP communications, the use of encryption introduces more sources for problems, such as requiring key management, and it also requires a higher computational overhead. Remember Segal's Law. Ideally, it would work to have three or more Stratum 0 or Stratum 1 servers and use those servers as primary masters. Remember Segal's Law: having two NTP servers makes it hard to know which one is accurate. Two Stratum 0 servers would provide a more accurate timestamp because they are using a time source that is considered definitive.
608QUESTION 119 When sending messages using symmetric encryption, which of the following must happen FIRST?
609A. Exchange encryption key B. Establish digital signatures C. Agree on an encryption method D. Install digital certificates
610Correct Answer: C Section: (none) Explanation
611Explanation/Reference:
612QUESTION 120 Which of the following scenarios BEST describes an implementation of non-repudiation?
613A. A user logs into a domain workstation and access network file shares for another department B. A user remotely logs into the mail server with another user's credentials C. A user sends a digitally signed email to the entire finance department about an upcoming meeting
614D. A user access the workstation registry to make unauthorized changes to enable functionality within an application
615Correct Answer: C Section: (none) Explanation
616Explanation/Reference:
617QUESTION 121 An office manager found a folder that included documents with various types of data relating to corporate clients. The office manager notified the data included dates of birth, addresses, and phone numbers for the clients. The office manager then reported this finding to the security compliance officer. Which of the following portions of the policy would the security officer need to consult to determine if a breach has occurred?
618A. Public B. Private C. PHI D. PII
619Correct Answer: D Section: (none) Explanation
620Explanation/Reference:
621QUESTION 122 Which of the following is an asymmetric function that generates a new and separate key every time it runs?
622A. RSA B. DSA C. DHE D. HMAC E. PBKDF2
623Correct Answer: C Section: (none) Explanation
624Explanation/Reference: Although Diffie–Hellman key agreement itself is a non-authenticated key-agreement protocol, it provides the basis for a variety of authenticated protocols, and is used to provide forward secrecy in Transport Layer Security's ephemeral modes (referred to as EDH or DHE depending on the cipher suite).
625QUESTION 123 Which of the following would be considered multifactor authentication?
626A. Hardware token and smart card B. Voice recognition and retina scan C. Strong password and fingerprint D. PIN and security questions
627Correct Answer: C
628Section: (none) Explanation
629Explanation/Reference:
630QUESTION 124 Users report the following message appear when browsing to the company's secure site: This website cannot be trusted. Which of the following actions should a security analyst take to resolve these messages? (Select TWO)
631A. Verify the certificate has not expired on the server B. Ensure the certificate has a .pfx extension on the server C. Update the root certificate into the client computer certificate store D. Install the updated private key on the web server E. Have users clear their browsing history and relaunch the session
632Correct Answer: AC Section: (none) Explanation
633Explanation/Reference:
634QUESTION 125 Despite having implemented password policies, users continue to set the same weak passwords and reuse old passwords. Which of the following technical controls would help prevent these policy violations?
635A. Password expiration B. Password length C. Password complexity D. Password history E. Password lockout
636Correct Answer: AD Section: (none) Explanation
637Explanation/Reference:
638QUESTION 126 A security auditor is testing perimeter security in a building that is protected by badge readers. Which of the following types of attacks would MOST likely gain access?
639A. Phishing B. Man-in-the-middle C. Tailgating D. Watering hole E. Shoulder surfing
640Correct Answer: C Section: (none) Explanation
641Explanation/Reference:
642QUESTION 127 Which of the following encryption methods does PKI typically use to securely protect keys?
643A. Elliptic curve B. Digital signatures C. Asymmetric D. Obfuscation
644Correct Answer: C Section: (none) Explanation
645Explanation/Reference:
646QUESTION 128 A department head at a university resigned on the first day of spring semester. It was subsequently determined that the department head deleted numerous files and directories from the server-based home directory while the campus was closed. Which of the following policies or procedures could have prevented this form occurring?
647A. Time-of-day restrictions B. Permissions auditing and review C. Offboarding D. Account expiration
648Correct Answer: C Section: (none) Explanation
649Explanation/Reference:
650QUESTION 129 An organization wants to upgrade its enterprise-wide desktop computer solution. The organization currently has 500 PCs active on the network. the Chief Information Security Officer (CISO) suggests that the organization employ desktop imaging technology for such a large scale upgrade. Which of the following is a security benefit of implementing an imaging solution?
651A. it allows for faster deployment B. it provides a consistent baseline C. It reduces the number of vulnerabilities D. It decreases the boot time
652Correct Answer: B Section: (none) Explanation
653Explanation/Reference:
654QUESTION 130 A senior incident response manager receives a call about some external IPs communicating with internal
655computers during off hours. Which of the following types of malware is MOST likely causing this issue?
656A. Botnet B. Ransomware C. Polymorphic malware D. Armored virus
657Correct Answer: A Section: (none) Explanation
658Explanation/Reference:
659QUESTION 131 An organization has implemented an IPSec VPN access for remote users. Which of the following IPSec modes would be the MOST secure for this organization to implement?
660A. Tunnel mode B. Transport mode C. AH-only mode D. ESP-only mode
661Correct Answer: A Section: (none) Explanation
662Explanation/Reference: In both ESP and AH cases with IPSec Transport mode, the IP header is exposed. The IP header is not exposed in IPSec Tunnel mode.
663QUESTION 132 A security engineer is configuring a wireless network with EAP-TLS. Which of the following activities is a requirement for this configuration?
664A. Setting up a TACACS+ server B. Configuring federation between authentication servers C. Enabling TOTP D. Deploying certificates to endpoint devices
665Correct Answer: D Section: (none) Explanation
666Explanation/Reference:
667QUESTION 133 Several workstations on a network are found to be on OS versions that are vulnerable to a specific attack. Which of the following is considered to be a corrective action to combat this vulnerability?
668A. Install an antivirus definition patch B. Educate the workstation users C. Leverage server isolation D. Install a vendor-supplied patch
669E. Install an intrusion detection system
670Correct Answer: D Section: (none) Explanation
671Explanation/Reference:
672QUESTION 134 A user suspects someone has been accessing a home network without permission by spoofing the MAC address of an authorized system. While  attempting to determine if an unauthorized user is logging into the home network, the user reviews the wireless router, which shows the following table for systems that are currently on the home network:
673Hostname IP Address   MAC                MAC Filter DadPC    192.168.1.15 00:1D:1A:44:17:B5  On MomPC    192.168.1.15 21:13:D6:C5:42:A2  Off JuniorPC 192.168.2.16 42:A7:D1:25:11:52  On Unknown  192.168.1.18 10:B3:22:1A:FF:21 Off
674Which of the following should be the NEXT step to determine if there is an unauthorized user on the network?
675A. Apply MAC filtering and see if the router drops any of the systems B. Physically check each of the authorized systems to determine if they are logged onto the network C. Deny the "unknown" host because the hostname is not known and MAC filtering is not applied to this host D. Conduct a ping sweep of each of the authorized systems and see if an echo response is received
676Correct Answer: A Section: (none) Explanation
677Explanation/Reference: Dad's PC and Mom's PC have the same IP address. One of them is doing ARP spoofing.
678QUESTION 135 The POODLE attack is an MITM exploit that affects:
679A. TLS1.0 with CBC mode cipher B. SSLv2.0 with CBC mode cipher C. SSLv3.0 with CBC mode cipher D. SSLv3.0 with ECB mode cipher
680Correct Answer: C Section: (none) Explanation
681Explanation/Reference: A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode.
682How To Protect your Server Against the POODLE SSLv3 Vulnerability
683On October 14th, 2014, a vulnerability in version 3 of the SSL encryption protocol was disclosed. This vulnerability, dubbed POODLE (Padding Oracle On Downgraded Legacy Encryption), allows an attacker to read information encrypted with this version of the protocol in plain text using a man-in-the-middle attack.
684Although SSLv3 is an older version of the protocol which is mainly obsolete, many pieces of software still fall back on SSLv3 if better encryption options are not available. More importantly, it is possible for an attacker to force SSLv3 connections if it is an available alternative for both participants attempting a connection.
685The POODLE vulnerability affects any services or clients that make it possible to communicate using SSLv3. Because this is a flaw with the protocol design, and not an implementation issue, every piece of software that uses SSLv3 is vulnerable.
686To find out more information about the vulnerability, consult the CVE information found at CVE-2014-3566.
687What is the POODLE Vulnerability? The POODLE vulnerability is a weakness in version 3 of the SSL protocol that allows an attacker in a man-inthe-middle context to decipher the plain text content of an SSLv3 encrypted message.
688Who is Affected by this Vulnerability? This vulnerability affects every piece of software that can be coerced into communicating with SSLv3. This means that any software that implements a fallback mechanism that includes SSLv3 support is vulnerable and can be exploited.
689Some common pieces of software that may be affected are web browsers, web servers, VPN servers, mail servers, etc.
690How Does It Work? In short, the POODLE vulnerability exists because the SSLv3 protocol does not adequately check the padding bytes that are sent with encrypted messages.
691Since these cannot be verified by the receiving party, an attacker can replace these and pass them on to the intended destination. When done in a specific way, the modified payload will potentially be accepted by the recipient without complaint.
692An average of once out of every 256 requests will accepted at the destination, allowing the attacker to decrypt a single byte. This can be repeated easily in order to progressively decrypt additional bytes. Any attacker able to repeatedly force a participant to resend data using this protocol can break the encryption in a very short amount of time.
693How Can I Protect Myself? Actions should be taken to ensure that you are not vulnerable in your roles as both a client and a server. Since encryption is usually negotiated between clients and servers, it is an issue that involves both parties.
694Servers and clients should should take steps to disable SSLv3 support completely. Many applications use better encryption by default, but implement SSLv3 support as a fallback option. This should be disabled, as a malicious user can force SSLv3 communication if both participants allow it as an acceptable method.
695QUESTION 136 Security administrators attempted corrective action after a phishing attack. Users are still experiencing trouble logging in, as well as an increase in account lockouts. Users' email contacts are complaining of an increase in spam and social networking requests. Due to the large number of affected accounts, remediation must be accomplished quickly. Which of the following actions should be taken FIRST? (Select TWO)
696A. Disable the compromised accounts B. Update WAF rules to block social networks C. Remove the compromised accounts with all AD groups D. Change the compromised accounts' passwords E. Disable the open relay on the email server F. Enable sender policy framework
697Correct Answer: EF Section: (none)
698Explanation
699Explanation/Reference: Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators.
700n a Small Business Server environment, you may have to prevent your Microsoft Exchange Server-based server from being used as an open relay SMTP server for unsolicited commercial e-mail messages, or spam. You may also have to clean up the Exchange server's SMTP queues to delete the unsolicited commercial email messages. If your Exchange server is being used as an open SMTP relay, you may experience one or more of the following symptoms:  - The Exchange server cannot deliver outbound SMTP mail to a growing list of e-mail domains. - Internet browsing is slow from the server and from local area network (LAN) clients. - Free disk space on the Exchange server in the location of the Exchange information store databases or the Exchange information store transaction logs is reduced more rapidly than you expect. - The Microsoft Exchange information store databases spontaneously dismount. You may be able to manually mount the stores by using Exchange System Manager, but the stores may dismount on their own after they run for a short time. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
701QUESTION 137 Ann, a security administrator, wants to ensure credentials are encrypted in transit when implementing a RADIUS server for SSO. Which of the following are needed given these requirements? (Select TWO)
702A. Public key B. Shared key C. Elliptic curve D. MD5 E. Private key F. DES
703Correct Answer: AE Section: (none) Explanation
704Explanation/Reference:
705QUESTION 138 Which of the following allows an auditor to test proprietary-software compiled code for security flaws?
706A. Fuzzing B. Static review C. Code signing D. Regression testing
707Correct Answer: A Section: (none) Explanation
708Explanation/Reference:
709QUESTION 139
710Which of the following s the BEST reason to run an untested application is a sandbox?
711A. To allow the application to take full advantage of the host system's resources and storage B. To utilize the host systems antivirus and firewall applications instead of running it own protection C. To prevent the application from acquiring escalated privileges and accessing its host system D. To increase application processing speed so the host system can perform real-time logging
712Correct Answer: C Section: (none) Explanation
713Explanation/Reference:
714QUESTION 140 A manager wants to distribute a report to several other managers within the company. Some of them reside in remote locations that are not connected to the domain but have a local server. Because there is sensitive data within the report and the size is beyond the limit of the email attachment size, emailing the report is not an option. Which of the following protocols should be implemented to distribute the report securely? (Select THREE)
715A. S/MIME B. SSH C. SNMPv3 D. FTPS E. SRTP F. HTTPS G. LDAPS
716Correct Answer: BD Section: (none) Explanation
717Explanation/Reference:
718QUESTION 141 A company is performing an analysis of the corporate enterprise network with the intent of identifying what will cause losses in revenue, referrals, and/or reputation when out of commission. Which of the following is an element of a BIA that is being addressed?
719A. Mission-essential function B. Single point of failure C. backup and restoration plans D. Identification of critical systems
720Correct Answer: D Section: (none) Explanation
721Explanation/Reference: The BIA is composed of the following three steps: Determine mission/business processes and recovery criticality. Mission/business processes supported by the system are identified and the impact of a system disruption to those processes is determined along with outage impacts and estimated downtime.
722QUESTION 142 Ann, a user, states that her machine has been behaving erratically over the past week. She has experienced slowness and input lag and found text files that appear to contain pieces of her emails or online conversations with coworkers. The technician runs a standard virus scan but detects nothing. Which of the following types of malware has infected the machine?
723A. Ransomware B. Rootkit C. Backdoor D. Keylogger
724Correct Answer: D Section: (none) Explanation
725Explanation/Reference:
726QUESTION 143 A security analyst is attempting to identify vulnerabilities in a customer's web application without impacting the system or its data. Which of the following BEST describes the vulnerability scanning concept performed?
727A. Aggressive scan B. Passive scan C. Non-credentialed scan D. Compliance scan
728Correct Answer: B Section: (none) Explanation
729Explanation/Reference: Passive scanning is a method of vulnerability detection that relies on information gleaned from network data that is captured from a target computer without direct interaction.
730Packet sniffing applications can be used for passive scanning to reveal information such as operating system, known protocols running on non-standard ports and active network applications with known bugs. Passive scanning may be conducted by a network administrator scanning for security vulnerabilities or by an intruder as a preliminary to an active attack.
731For an intruder, passive scanning's main advantage is that it does not leave a trail that could alert users or administrators to their activities. For an administrator, the main advantage is that it doesn't risk causing undesired behavior on the target computer, such as freezes. Because of these advantages, passive scanning need not be limited to a narrow time frame to minimize risk or disruption, which means that it is likely to return more information.
732Passive scanning does have limitations. It is not as complete in detail as active vulnerability scanning and cannot detect any applications that are not currently sending out traffic; nor can it distinguish false information put out for obfuscation.
733QUESTION 144 A systems administrator wants to implement a wireless protocol that will allow the organization to authenticate mobile devices prior to providing the user with a captive portal login. Which of the following should the systems administrator configure?
734A. L2TP with MAC filtering B. EAP-TTLS
735C. WPA2-CCMP with PSK D. RADIUS federation
736Correct Answer: D Section: (none) Explanation
737Explanation/Reference: RADIUS generally includes 802.1X that pre-authenticates devices.
738QUESTION 145 A user receives an email from ISP indicating malicious traffic coming from the user's home network is detected. The traffic appears to be Linux-based, and it is targeting a website that was recently featured on the news as being taken offline by an Internet attack. The only Linux device on the network is a home surveillance camera system. Which of the following BEST describes what is happening?
739A. The camera system is infected with a bot. B. The camera system is infected with a RAT. C. The camera system is infected with a Trojan. D. The camera system is infected with a backdoor. 
740Correct Answer: A Section: (none) Explanation
741Explanation/Referenc