#1
An attacker has overloaded an API call with excessive data, enabling the execution of unauthorized code. Which type of attack does this best describe?
❍ A. Buffer overflow
❍ B. Replay attack
❍ C. Session hijacking
❍ D. DDoS
What is: A Buffer Overflow
A company's outgoing email server currently uses SMTP with no encryption. The security administrator wants to implement email client encryption without changing the existing server-to-server communication. Which of the following would be the BEST way to implement this requirement?
❍ A. Implement Secure IMAP
❍ B. Require the use of S/MIME
❍ C. Install an SSL certificate on the email server
❍ D. Use a VPN tunnel between email clients
What is: B Require the use of S/MIME
A user has assigned individual rights and permissions
to a file on their network drive. The user adds three
additional individuals to have read-only access to the
file. Which of the following would describe this access
control model?
❍ A. DAC
❍ B. MAC
❍ C. ABAC
❍ D. RBAC
A. DAC
A42. A network administrator has installed a new access point, but only a portion of the wireless devices are able to connect to the network. Other devices can see the access point, but they are not able to connect even when using the correct wireless settings. Which of the following security features was MOST likely enabled?
❍ A. MAC filtering
❍ B. SSID broadcast suppression
❍ C. 802.1X authentication
❍ D. Anti-spoofing
What is: A. MAC filtering
A user connects to a third-party website and receives this message:
Your connection is not private.
NET::ERR_CERT_INVALID
Which of the following attacks would be the MOST
likely reason
for this message?
❍ A. Brute force
❍ B. DoS
❍ C. On-path
❍ D. Disassociation
What is: C. On-path
A security administrator has been asked to respond to
a potential security breach of the company’s databases, and they need to gather the most volatile data before powering down the database servers. In which order should they collect this information?
❍ A. CPU registers, temporary files, memory,
remote monitoring data
❍ B. Memory, CPU registers, remote monitoring data,
temporary files
❍ C. Memory, CPU registers, temporary files,
remote monitoring data
❍ D. CPU registers, memory, temporary files,
remote monitoring data
What is: D. CPU registers, memory, temporary files, remote monitoring data
A security administrator, Elizabeth is concerned about
the potential for data exfiltration using external storage drives. Which of the following would be the BEST way to prevent this data exfiltration method?
❍ A. Create an operating system security policy to
prevent the use of removable media
❍ B. Monitor removable media usage in host-based
firewall logs
❍ C. Only allow applications that do not use
removable media
❍ D. Define a removable media block rule in the UTM
What is: A. Create an operating system security policy to prevent the use of removable media
A remote user has received a text message requesting
login details to the corporate VPN server. Which of the
following would BEST describe this message?
❍ A. Brute force
❍ B. Prepending
❍ C. Typosquatting
❍ D. Smishing
What is: D. Smishing
A manufacturing company has moved an inventory
application from its internal systems to a PaaS service. Which of the following would be the BEST way to manage security policies on this new service?
❍ A. DLP
❍ B. SIEM
❍ C. IPS
❍ D. CASB
What is: D. CASB
A system administrator, Daniel, is working on a contract that will specify a minimum required uptime for a set of Internet-facing firewalls. Daniel needs to know how often the firewall hardware is expected to fail between repairs. Which of the following would BEST describe this information?
❍ A. MTBF
❍ B. RTO
❍ C. MTTR
❍ D. MTTF
What is: A. MTBF (Mean Time Between Failures)
How can a company ensure that all data on a mobile
Is the device unrecoverable if it is lost or stolen?
❍ A. Containerization
❍ B. Geofencing
❍ C. Screen locks
❍ D. Remote wipe
What is: D. Remote Wipe
A CISO (Chief Information Security Officer) would
like to decrease the response time when addressing
security incidents. Unfortunately, the company does not have the budget to hire additional security engineers. Which of the following would assist the CISO with this requirement?
❍ A. ISO 27701
❍ B. PKI
❍ C. IaaS
❍ D. SOAR
Which of the following is true of a rainbow table?
(Select TWO)
❍ A. The rainbow table is built in real-time
during the attack
❍ B. Rainbow tables are the most effective
online attack type
❍ C. Rainbow tables require significant CPU cycles
at attack time
❍ D. Different tables are required for different
hashing methods
❍ E. A rainbow table won’t be useful if the
passwords are salted
What is: D. Different tables are required for different
hashing methods and E. A rainbow table won’t be useful if the passwords are salted
A security administrator needs to identify all computers
on the company network infected with a specific malware
variant. Which of the following would be the BEST way
to identify these systems?
❍ A. Honeynet
❍ B. Data masking
❍ C. DNS sinkhole
❍ D. DLP
What Is: C. DNS sinkhole
Which of the following would be commonly provided
by a CASB? (Select TWO)
❍ A. List of all internal Windows devices that have
not installed the latest security patches
❍ B. List of applications in use
❍ C. Centralized log storage facility
❍ D. List of network outages for the previous month
❍ E. Verification of encrypted data transfers
❍ F. VPN connectivity for remote users
What is: B: List of Applications in use and E.Verification of encrypted data transfers
Rodney, a security engineer, is viewing this record from
the firewall logs:
UTC 04/05/2018 03:09:15809 AV Gateway Alert
136.127.92.171 80 -> 10.16.10.14 60818
Gateway Anti-Virus Alert:
XPACK.A_7854 (Trojan) blocked.
Which of the following can be observed from this
log information?
❍ A. The victim's IP address is 136.127.92.171
❍ B. A download was blocked from a web server
❍ C. A botnet DDoS attack was blocked
❍ D. The Trojan was blocked, but the file was not
What is: B. A download was blocked from a web server
A file server has a full backup performed each Monday
at 1 AM. Incremental backups are performed at 1 AM
on Tuesday, Wednesday, Thursday, and Friday. The system administrator needs to perform a full recovery of the file server on Thursday afternoon. How many backup sets would be required to complete the recovery?
❍ A. 2
❍ B. 3
❍ C. 4
❍ D. 1
What is: C. 4
Which of these cloud deployment models would share resources between a private virtualized data center and externally available cloud services?
❍ A. SaaS
❍ B. Community
❍ C. Hybrid
❍ D. Containerization
What is: C. Hybrid
Which of these threat actors would be MOST likely to
attack systems for direct financial gain?
❍ A. Organized crime
❍ B. Hacktivist
❍ C. Nation-state
❍ D. Competitor
What is: A. Organized Crime
When a home user connects to the corporate VPN, they
are no longer able to print to their local network printer. Once the user disconnects from the VPN, the printer works normally. Which of the following would be the MOST likely reason for this issue?
❍ A. The VPN uses IPSec instead of SSL
❍ B. Printer traffic is filtered by the VPN client
❍ C. The VPN is stateful
❍ D. The VPN tunnel is configured for full tunnel
What is: D. The VPN tunnel is configured for full tunnel
A web-based manufacturing company processes
monthly charges to credit card information saved in the
customer's profile. Which of the following standards
would be required to maintain this payment information?
❍ A. GDPR
❍ B. ISO 27001
❍ C. PCI DSS
❍ D. CSA CCM
What is: C. PCI DSS
A network administrator would like each user to
authenticate with their personal username and
password when connecting to the company's wireless
network. Which of the following should the network
does the administrator configure the wireless access points?
❍ A. WPA2-PSK
❍ B. 802.1X
❍ C. WPS
❍ D. WPA2-AES
What is: B. 802.1x
A data breach has occurred in a large insurance company. A security administrator is building new servers and security systems to get all of the financial systems back online. Which part of the incident response process would BEST describe these actions?
❍ A. Lessons learned
❍ B. Isolation and containment
❍ C. Reconstitution
❍ D. Precursors
What is: C. Reconstitution
Which of the following standards provides information
on privacy and managing PII?
❍ A. ISO 31000
❍ B. ISO 27002
❍ C. ISO 27701
❍ D. ISO 27001
What is: C. ISO 27701
Which cryptographic method is used to add trust to a
digital certificate?
❍ A. X.509
❍ B. Hash
❍ C. Symmetric encryption
❍ D. Digital signature
What is: D. Digital Signature