NEW QUESTION 1
While checking logs, a security engineer notices a number of end users suddenly downloading files with the .t ar.gz extension. Closer examination of the files reveals they are PE32 files. The end users state they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an external email containing an infected MHT file with an href link a week prior. Which of the following is MOST likely occurring?

• A. A RAT was installed and is transferring additional exploit tools.
• B. The workstations are beaconing to a command-and-control server.
• C. A logic bomb was executed and is responsible for the data transfers.
• D. A fireless virus is spreading in the local network environment.

Answer: A

NEW QUESTION 2
Which of the following incident response steps involves actions to protect critical systems while maintaining business operations?

• A. Investigation
• B. Containment
• C. Recovery
• D. Lessons learned

Answer: B

NEW QUESTION 3
Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?

• A. The document is a honeyfile and is meant to attract the attention of a cyberintruder.
• B. The document is a backup file if the system needs to be recovered.
• C. The document is a standard file that the OS needs to verify the login credentials.
• D. The document is a keylogger that stores all keystrokes should the account be compromised.

Answer: A

NEW QUESTION 4
A company recently transitioned to a strictly BYOD culture due to the cost of replacing lost or damaged corporate-owned mobile devices. Which of the following technologies would be BEST to balance the BYOD culture while also protecting the company’s data?

• A. Containerization
• B. Geofencing
• C. Full-disk encryption
• D. Remote wipe

Answer: C

NEW QUESTION 5
Which of the following are requirements that must be configured for PCI DSS compliance? (Select TWO).

• A. Testing security systems and processes regularly
• B. Installing and maintaining a web proxy to protect cardholder data
• C. Assigning a unique ID to each person with computer access
• D. Encrypting transmission of cardholder data across private networks
• E. Benchmarking security awareness training for contractors
• F. Using vendor-supplied default passwords for system passwords

Answer: BD

NEW QUESTION 6
A network administrator would like to configure a site-to-site VPN utilizing iPSec. The administrator wants the tunnel to be established with data integrity encryption, authentication and anti- replay functions Which of the following should the administrator use when configuring the VPN?

• A. AH
• B. EDR
• C. ESP
• D. DNSSEC

Answer: C

NEW QUESTION 7
A network administrator is setting up wireless access points in all the conference rooms and wants to authenticate device using PKI. Which of the following should the administrator configure?

• A. A captive portal
• B. PSK
• C. 802.1X
• D. WPS

Answer: C

NEW QUESTION 8
A cybersecurity department purchased o new PAM solution. The team is planning to randomize the service account credentials of the Windows server first. Which of the following would be the BEST method to increase the security on the Linux server?

• A. Randomize the shared credentials
• B. Use only guest accounts to connect.
• C. Use SSH keys and remove generic passwords
• D. Remove all user accounts.

Answer: C

NEW QUESTION 9
Which of the following cloud models provides clients with servers, storage, and networks but nothing else?

• A. SaaS
• B. PaaS
• C. IaaS
• D. DaaS

Answer: C

NEW QUESTION 10
Which of the following describes the ability of code to target a hypervisor from inside

• A. Fog computing
• B. VM escape
• C. Software-defined networking
• D. Image forgery
• E. Container breakout

Answer: B

NEW QUESTION 11
A smart retail business has a local store and a newly established and growing online storefront. A recent storm caused a power outage to the business and the local ISP, resulting in several hours of lost sales and delayed order processing. The business owner now needs to ensure two things:
* Protection from power outages
* Always-available connectivity In case of an outage
The owner has decided to implement battery backups for the computer equipment Which of the following would BEST fulfill the owner's second need?

• A. Lease a point-to-point circuit to provide dedicated access.
• B. Connect the business router to its own dedicated UPS.
• C. Purchase services from a cloud provider for high availability
• D. Replace the business's wired network with a wireless network.

Answer: C

NEW QUESTION 12
A database administrator needs to ensure all passwords are stored in a secure manner, so the administrate adds randomly generated data to each password before string. Which of the following techniques BEST explains this action?

• A. Predictability
• B. Key stretching
• C. Salting
• D. Hashing

Answer: C

NEW QUESTION 13
The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and servers. Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in the future?

• A. Install a NIDS device at the boundary.
• B. Segment the network with firewalls.
• C. Update all antivirus signatures daily.
• D. Implement application blacklisting.

Answer: B

NEW QUESTION 14
Which of the following algorithms has the SMALLEST key size?

• A. DES
• B. Twofish
• C. RSA
• D. AES

Answer: B

NEW QUESTION 15
A symmetric encryption algorithm Is BEST suited for:

• A. key-exchange scalability.
• B. protecting large amounts of data.
• C. providing hashing capabilities,
• D. implementing non-repudiation.

Answer: D

NEW QUESTION 16
An auditor is performing an assessment of a security appliance with an embedded OS that was vulnerable during the last two assessments. Which of the following BEST explains the appliance’s vulnerable state?

• A. The system was configured with weak default security settings.
• B. The device uses weak encryption ciphers.
• C. The vendor has not supplied a patch for the appliance.
• D. The appliance requires administrative credentials for the assessment.

Answer: C

NEW QUESTION 17
A security analyst is reviewing logs on a server and observes the following output:

Which of the following is the security analyst observing?

• A. A rainbow table attack
• B. A password-spraying attack
• C. A dictionary attack
• D. A keylogger attack

Answer: C

NEW QUESTION 18
Which of the following will MOST likely adversely impact the operations of unpatched traditional programmable-logic controllers, running a back-end LAMP server and OT systems with human-management interfaces that are accessible over the Internet via a web interface? (Choose two.)

• A. Cross-site scripting
• B. Data exfiltration
• C. Poor system logging
• D. Weak encryption
• E. SQL injection
• F. Server-side request forgery

Answer: DF

NEW QUESTION 19
A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom. Which of the following would BEST prevent this attack from reoccurring?

• A. Configure the perimeter firewall to deny inbound external connections to SMB ports.
• B. Ensure endpoint detection and response systems are alerting on suspicious SMB connections.
• C. Deny unauthenticated users access to shared network folders.
• D. Verify computers are set to install monthly operating system, updates automatically.

Answer: A

NEW QUESTION 20
A security engineer needs to Implement the following requirements:
• All Layer 2 switches should leverage Active Directory tor authentication.
• All Layer 2 switches should use local fallback authentication If Active Directory Is offline.
• All Layer 2 switches are not the same and are manufactured by several vendors.
Which of the following actions should the engineer take to meet these requirements? (Select TWO).

• A. Implement RADIUS.
• B. Configure AAA on the switch with local login as secondary.
• C. Configure port security on the switch with the secondary login method.
• D. Implement TACACS+
• E. Enable the local firewall on the Active Directory server.
• F. Implement a DHCP server.

Answer: AB

NEW QUESTION 21
A company recently added a DR site and is redesigning the network. Users at the DR site are having issues browsing websites. INSTRUCTIONS
Click on each firewall to do the following:
Deny cleartext web traffic.
Ensure secure management protocols are used.
Resolve issues at the DR site.
The ruleset order cannot be modified due to outside constraints.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

• A.

Answer: A

Explanation:
See explanation below.
Explanation
Firewall 1:


DNS Rule – ANY --> ANY --> DNS --> PERMIT
HTTPS Outbound – 10.0.0.1/24 --> ANY --> HTTPS --> PERMIT Management – ANY --> ANY --> SSH --> PERMIT
HTTPS Inbound – ANY --> ANY --> HTTPS --> PERMIT HTTP Inbound – ANY --> ANY --> HTTP --> DENY
Firewall 2:


Firewall 3:


DNS Rule – ANY --> ANY --> DNS --> PERMIT
HTTPS Outbound – 192.168.0.1/24 --> ANY --> HTTPS --> PERMIT Management – ANY --> ANY --> SSH --> PERMIT
HTTPS Inbound – ANY --> ANY --> HTTPS --> PERMIT HTTP Inbound – ANY --> ANY --> HTTP --> DENY

NEW QUESTION 22
A user recent an SMS on a mobile phone that asked for bank delays. Which of the following social-engineering techniques was used in this case?

• A. SPIM
• B. Vishing
• C. Spear phishing
• D. Smishing

Answer: D

NEW QUESTION 23
A host was infected with malware. During the incident response, Joe, a user, reported that he did not receive any emails with links, but he had been browsing the Internet all day. Which of the following would MOST likely show where the malware originated?

• A. The DNS logs
• B. The web server logs
• C. The SIP traffic logs
• D. The SNMP logs

Answer: A

NEW QUESTION 24
......