Chapter 6
Practice Exam 1

1. While reviewing network flow logs, John sees that network flow on a particular segment suddenly dropped to zero. What is the most likely cause of this?
   1. A denial-of-service attack
   2. A link failure
   3. High bandwidth consumption
   4. Beaconing
2. Charlotte is having a dispute with a coworker over access to information contained in a database maintained by her coworker's department. Charlotte insists that she needs the information to carry out her job responsibilities, whereas the coworker insists that nobody outside the department is allowed to access the information. Charlotte does not agree that the other department should be able to make this decision, and Charlotte's supervisor agrees with her. What type of policy could Charlotte turn to for the most applicable guidance?
   1. Data classification policy
   2. Data retention policy
   3. Data ownership policy
   4. Acceptable use policy
3. Saanvi is conducting the recovery process after his organization experienced a security incident. During that process, he plans to apply patches to all of the systems in his environment. Which one of the following should be his highest priority for patching?
   1. Windows systems
   2. Systems involved in the incident
   3. Linux systems
   4. Web servers
4. Susan's organization suffered from a major breach that was attributed to an advanced persistent threat (APT) that used exploits of zero-day vulnerabilities to gain control of systems on her company's network. Which of the following is the least appropriate solution for Susan to recommend to help prevent future attacks of this type?
   1. Heuristic attack detection methods
   2. Signature-based attack detection methods
   3. Segmentation
   4. Leverage threat intelligence
5. During his investigation of a Windows system, Eric discovered that files were deleted and wants to determine whether a specific file previously existed on the computer. Which of the following is the least likely to be a potential location to discover evidence supporting that theory?
   1. Windows registry
   2. Master File Table
   3. INDX files
   4. Event logs
6. As part of her duties as an SOC analyst, Emily is tasked with monitoring intrusion detection sensors that cover her employer's corporate headquarters network. During her shift, Emily's IDS alarms report that a network scan has occurred from a system with IP address 10.0.11.19 on the organization's WPA2 Enterprise wireless network aimed at systems in the finance division. What data source should she check first?
   1. Host firewall logs
   2. AD authentication logs
   3. Wireless authentication logs
   4. WAF logs
7. Casey's incident response process leads her to a production server that must stay online for her company's business to remain operational. What method should she use to capture the data she needs?
   1. Live image to an external drive.
   2. Live image to the system's primary drive.
   3. Take the system offline and image to an external drive.
   4. Take the system offline, install a write blocker on the system's primary drive, and then image it to an external drive.
8. During a routine upgrade, Maria inadvertently changes the permissions to a critical directory, causing an outage of her organization's RADIUS infrastructure. How should this threat be categorized using NIST's threat categories?
   1. Adversarial
   2. Accidental
   3. Structural
   4. Environmental
9. What does the nmap response “filtered” mean in port scan results?
   1. nmap cannot tell whether the port is open or closed.
   2. A firewall was detected.
   3. An IPS was detected.
   4. There is no application listening, but there may be one at any time.
10. Darcy is the security administrator for a hospital that operates in the United States and is subject to the Health Insurance Portability and Accountability Act (HIPAA). She is designing a vulnerability scanning program for the hospital's datacenter that stores and processes electronic protected health information (ePHI). What is the minimum scanning frequency for this environment, assuming that the scan shows no critical vulnerabilities?
    1. Every 30 days
    2. Every 90 days
    3. Every 180 days
    4. No scanning is required.
11. During her review of incident logs, Deepa discovers the initial entry via SSH on a front-facing bastion host (A) at 8:02 a.m. If the network that Deepa is responsible for is designed as shown here, what is the most likely diagnosis if the second intrusion shows up on host B at 7:15 a.m.?

    

    1. Internal host B was previously compromised.
    2. Host A was compromised; then host B was compromised.
    3. Neither host B nor host A are synchronized to NTP properly.
    4. An internal threat compromised host B and then host A.
12. Matt recently ran a vulnerability scan of his organization's network and received the results shown here. He would like to remediate the server with the highest number of the most serious vulnerabilities first. Which one of the following servers should be on his highest priority list?

    

    1. Server A
    2. Server B
    3. Server C
    4. Server D
13. Saanvi has been tasked with conducting a risk assessment for the midsized bank that he works at because of a recent compromise of their online banking web application. Saanvi has chosen to use the NIST 800-30 risk assessment framework shown here. What likelihood of occurrence should he assign to breaches of the web application?

    

    1. Low
    2. Medium
    3. High
    4. Cannot be determined from the information given
14. Hank's boss recently came back from a CEO summit event where he learned about the importance of cybersecurity and the role of vulnerability scanning. He asked Hank about the vulnerability scans conducted by the organization and suggested that instead of running weekly scans that they simply configure the scanner to start a new scan immediately after the prior scan completes. How should Hank react to this request?
    1. Hank should inform the CEO that this would have a negative impact on system performance and is not recommended.
    2. Hank should immediately implement the CEO's suggestion.
    3. Hank should consider the request and work with networking and engineering teams on possible implementation.
    4. Hank should inform the CEO that there is no incremental security benefit from this approach and that he does not recommend it.
15. Selah's organization suffers an outage of its point-to-point encrypted VPN because of a system compromise at its ISP. What type of issue is this?
    1. Confidentiality
    2. Availability
    3. Integrity
    4. Accountability
16. Garrett is working with a database administrator to correct security issues on several servers managed by the database team. He would like to extract a report for the DBA that will provide useful information to assist in the remediation effort. Of the report templates shown here, which would be most useful to the DBA team?

    

    1. Qualys Top 20 Report
    2. Payment Card Industry (PCI) Technical Report
    3. Executive Report
    4. Technical Report
17. Jiang's SolarWinds network monitoring tools provide data about a system hosted in Amazon's AWS environment. When Jiang checks his server's average response time, he sees the results shown here.

    

    What action should Jiang take based on this information?

    1. He should increase the speed of his network link.
    2. He should check for scheduled tasks at the times he sees spike.
    3. He should ensure that his network card has the proper latency settings.
    4. He should perform additional diagnostics to determine the cause of the latency.
18. Alex notices the traffic shown here during a Wireshark packet capture. What is the host with IP address 10.0.2.11 most likely doing?

    

    1. UDP-based port scanning
    2. Network discovery via TCP
    3. SYN-based port scanning
    4. DNS-based discovery
19. Jenny is evaluating the security of her organization's network management practices. She discovers that the organization is using RADIUS for administrator authentication to network devices. What additional security control should also be in place to ensure secure operation?
    1. IPsec
    2. Kerberos
    3. TACACS+
    4. SSL
20. Jake is building a forensic image of a compromised drive using the dd command with its default settings. He finds that the imaging is going very slowly. What parameter should he adjust first?
    1. if
    2. bs
    3. of
    4. count
21. What purpose does a honeypot system serve when placed on a network as shown here?

    

    1. It prevents attackers from targeting production servers.
    2. It provides information about the techniques attackers are using.
    3. It slows down attackers like sticky honey.
    4. It provides real-time input to IDSs and IPSs.
22. Munju's security team has found consistent evidence of system compromise over a period of weeks, with additional evidence pointing to the systems they are investigating being compromised for years. Despite her team's best efforts, Munju has found that her team cannot seem to track down and completely remove the compromise. What type of attack is Munju likely dealing with?
    1. A Trojan horse
    2. An APT
    3. A rootkit
    4. A zero-day attack
23. Which one of the following metrics would be most useful in determining the effectiveness of a vulnerability remediation program?
    1. Number of critical vulnerabilities resolved
    2. Time to resolve critical vulnerabilities
    3. Number of new critical vulnerabilities per month
    4. Time to complete vulnerability scans
24. Mike's nmap scan of a system using the command nmap 192.168.1.100 does not return any results. What does Mike know about the system if he is sure of its IP address, and why?
    1. The system is not running any open services.
    2. All services are firewalled.
    3. There are no TCP services reachable on nmap's default 1000 TCP ports.
    4. There are no TCP services reachable on nmap's default 65535 TCP ports.
25. What is the purpose of creating an MD5 hash for a drive during the forensic imaging process?
    1. To prove that the drive's contents were not altered
    2. To prove that no data was deleted from the drive
    3. To prove that no files were placed on the drive
    4. All of the above
26. After completing his unsuccessful forensic analysis of the hard drive from a workstation that was compromised by malware, Ben sends it to be re-imaged and patched by his company's desktop support team. Shortly after the system returns to service, the device once again connects to the same botnet. What action should Ben take as part of his next forensic review if this is the only system showing symptoms like this?
    1. Verify that all patches are installed
    2. Destroy the system
    3. Validate the BIOS hash against a known good version
    4. Check for a system with a duplicate MAC address
27. Part of the forensic data that Susan was provided for her investigation was a Wireshark packet capture. The investigation is aimed at determining what type of media an employee was consuming during work. What is the more detailed analysis that Susan can do if she is provided with the data shown here?

    

    1. She can determine that the user was viewing a GIF.
    2. She can manually review the TCP stream to see what data was sent.
    3. She can export and view the GIF.
    4. She cannot determine what media was accessed using this data set.
28. Which one of the following models traces the steps that an attacker would commonly perform during an intrusion?
    1. MITRE ATT&CK
    2. Diamond
    3. Cyber Kill Chain
    4. STIX
29. Lukas is a cybersecurity analyst for a large company that relies on SCADA systems. What networking protocol is he most likely to find in use for those systems?
    1. CAN bus
    2. Modbus
    3. SoC
    4. RTOS
30. Mika wants to run an nmap scan that includes all TCP ports and uses service detection. Which of the following nmap commands should she execute?
    1. nmap -p0 -all -SC
    2. nmap -p 1-32768 -sVS
    3. nmap -p 1-65535 -sV -sS
    4. nmap -all -sVS
31. Which one of the following cloud service models relies on the cloud service provider to implement the greatest number of security controls?
    1. SaaS
    2. PaaS
    3. FaaS
    4. IaaS
32. Dan is a cybersecurity analyst for a healthcare organization. He ran a vulnerability scan of the VPN server used by his organization. His scan ran from inside the datacenter against a VPN server also located in the datacenter. The complete vulnerability report is shown here. What action should Dan take next?

    

    1. Dan should immediately remediate this vulnerability.
    2. Dan should schedule the vulnerability for remediation within the next 30 days.
    3. Dan should rerun the scan because this is likely a false positive report.
    4. Dan should take no action.
33. Gina is testing a firewall ruleset for use on her organization's new Check Point firewall. She would like the firewall to allow unrestricted web browsing for users on the internal network, with the exception of sites listed on a Blocked Hosts list that the cybersecurity team maintains. She designed the ruleset shown here. What error, if any, does it contain?

    

    1. Promiscuous rule
    2. Orphaned rule
    3. Shadowed rule
    4. The rule base does not contain an error.
34. Kwame received an alert from his organization's SIEM that it detected a potential attack against a web server on his network. However, he is unsure whether the traffic generating the alert actually entered the network from an external source or whether it came from inside the network. The NAT policy at the network perimeter firewall rewrites public IP addresses, making it difficult to assess this information based on IP addresses. Kwame would like to perform a manual log review to locate the source of the traffic. Where should he turn for the best information?
    1. Application server logs
    2. Database server logs
    3. Firewall logs
    4. Antimalware logs
35. Jim ran a traceroute command to discover the network path between his system and the CompTIA website. He received the results shown here. What can he conclude from these results?

    

    1. The CompTIA website is located in Chicago.
    2. The CompTIA website is down.
    3. The closest network device to the CompTIA site that Jim can identify is 216.182.225.74.
    4. The closest network device to the CompTIA site that Jim can identify is 216.55.11.62.
36. Which one of the following types of vulnerability scans would provide the least information about the security configuration of a system?
    1. Agent-based scan
    2. Credentialed scan
    3. Uncredentialed internal scan
    4. Uncredentialed external scan
37. After finishing a forensic case, Sam needs to wipe the media that he is using to prepare it for the next case. Which of the following methods is best suited to preparing the hard drive that he will use if he wants to be in compliance with NIST SP 800-88?
    1. Degauss the drive.
    2. Zero-write the drive.
    3. Seven rounds: all ones, all zeros, and five rounds of random values.
    4. Use the ATA Secure Erase command.
38. After reading the NIST standards for incident response, Mateo spends time configuring the NTP service on each of his servers, workstations, and appliances throughout his network. What phase of the incident response process is he working to improve?
    1. Preparation
    2. Detection and analysis
    3. Containment, eradication, and recovery
    4. Postincident activity
39. Latisha is the ISO for her company and is notified that a zero-day exploit has been released that can result in remote code execution on all Windows 10 workstations on her network because of an attack against Windows domain services. She wants to limit her exposure to this exploit but needs the systems to continue to be able to access the Internet. Which of the following approaches is best for her response?
    1. Firewalling
    2. Patching
    3. Isolation
    4. Segmentation
40. Luis has configured SNMP to gather information from his network devices and issues the following command:

     $ snmpgetnext -v 1 -c public device1 \ 

    He receives a response that includes the following data:

            ip.ipRouteTable.ipRouteEntry.ipRouteDest \
            ip.ipRouteTable.ipRouteEntry.ipRouteNextHop
            ip.ipRouteTable.ipRouteEntry.ipRouteDest.0.0.0.0 = IpAddress: 0.0.0.0
            ip.ipRouteTable.ipRouteEntry.ipRouteNextHop.0.0.0.0 = IpAddress: 10.0.11.1

    What local command could he have executed to gather the same information?

    1. traceroute
    2. route add default gw 10.0.11.1
    3. netstat -nr
    4. ping -r 10.0.11.1
41. After scanning a network device located in her organization's data center, Shannon noted the vulnerability shown here. What is the minimum version level of SNMP that Shannon should be running?

    

    1. 1.1
    2. 1.2
    3. 2
    4. 3
42. When Saanvi was called in to help with an incident recovery effort, he discovered that the network administrator had configured the network as shown here. What type of incident response action best describes what Saanvi has encountered?

    

    1. Segmentation
    2. Isolation
    3. Removal
    4. Network locking
43. As part of the forensic investigation of a Linux workstation, Alex needs to determine what commands may have been issued on the system. If no anti-forensic activities have taken place, what is the best location for Alex to check for a history of commands issued on the system?
    1. /var/log/commands.log
    2. $HOME/.bash_history
    3. $HOME/.commands.sqlite
    4. /var/log/authactions.log
44. Ben recently completed a risk analysis and determined that he should implement a new set of firewall rules to filter traffic from known suspect IP addresses. What type of risk management activity is he performing?
    1. Risk avoidance
    2. Risk acceptance
    3. Risk transference
    4. Risk mitigation
45. Crystal is attempting to determine the next task that she should take on from a list of security priorities. Her boss told her that she should focus on activities that have the most “bang for the buck.” Of the tasks shown here, which should she tackle first?

    

    1. Task 1
    2. Task 2
    3. Task 3
    4. Task 4
46. During the analysis of an incident that took place on her network, Sofia discovered that the attacker used a stolen cookie to access a web application. Which one of the following attack types most likely occurred?
    1. Man-in-the-middle
    2. Privilege escalation
    3. Cross-site scripting
    4. Session hijacking
47. When Pete connects to his organization's network, his PC runs the NAC software his systems administrator installed. The software communicates to the edge switch he is plugged into, which validates his login and system security state. What type of NAC solution is Pete using?
    1. Agent based, in-band
    2. Agentless, in-band
    3. Agent based, out-of-band
    4. Agentless, out-of-band
48. Curt is conducting a forensic analysis of a Windows system and needs to determine whether a program was set to automatically run. Which of the following locations should he check for this information?
    1. NTFS INDX files
    2. The registry
    3. Event logs
    4. Prefetch files
49. During a regulatory compliance assessment, Manish discovers that his organization has implemented a multifactor authentication requirement for systems that store and handle highly sensitive data. The system requires that users provide both a password and a four-digit PIN. What should Manish note in his findings about this system?
    1. The multifactor system provides two independent factors and provides an effective security control.
    2. The factors used are both the same type of factor, making the control less effective.
    3. The system uses only two factors and is not a true multifactor system. To qualify as multifactor, it should include at least three factors.
    4. The multifactor system's use of a four-digit PIN does not provide sufficient complexity, and additional length should be required for any PIN for secure environments.
50. What concept measures how easy data is to lose?
    1. Order of volatility
    2. Data transience
    3. Data loss prediction
    4. The Volatility Framework
51. During a reconnaissance exercise, Mika uses the following command:

            root@demo:~# nc -v 10.0.2.9 8080
            www.example.com [10.0.2.9] 8080 (http-alt) open
            GET / HTTP/1.0

    What is she doing?

    1. Checking for the HTTP server version using netcat
    2. Creating a reverse shell using netcar
    3. HTTP banner grabbing using netcat
    4. Executing an HTTP keep-alive using netcar
52. Steps like those listed here are an example of what type of incident response preparation?
    1. Visit otx.alienvault.com and the suspected C&C system's IP address on the top search input field.
    2. If the IP address is associated with malware C&C activity, create a ticket in the incident response tracking system.
    1. Creating a CSIRT
    2. Creating a playbook
    3. Creating an incident response plan
    4. Creating an IR-FAQ
53. While analyzing the vulnerability scan from her web server, Kristen discovers the issue shown here. Which one of the following solutions would best remedy the situation?

    

    1. Move from TLS 1.0 to SSL 3.0.
    2. Require IPsec connections to the server.
    3. Disable the use of TLS.
    4. Move from TLS 1.0 to TLS 1.2.
54. Charles is building an incident response playbook for his organization that will address command and control client-server traffic detection and response. Which of the following information sources is least likely to be part of his playbook?
    1. DNS query logs
    2. Threat intelligence feeds
    3. Honeypot data
    4. Notifications from internal staff about suspicious behavior
55. Which one of the following mechanisms may be used to enhance security in a context-based authentication system?
    1. Time of day
    2. Location
    3. Device fingerprint
    4. All of the above
56. Latisha's organization has faced a significant increase in successful phishing attacks, resulting in compromised accounts. She knows that she needs to implement additional technical controls to prevent successful attacks. Which of the following controls will be the most effective while remaining relatively simple and inexpensive to deploy?
    1. Increased password complexity requirements
    2. Application or token-based multifactor authentication
    3. Biometric-based multifactor authentication
    4. OAuth-based single sign-on
57. Carol recently fell victim to a phishing attack. When she clicked the link in an email message that she received, she was sent to her organization's central authentication service and logged in successfully. She did verify the URL and certificate to validate that the authentication server was genuine. After authenticating, she was sent to a form that collected sensitive personal information that was sent to an attacker. What type of vulnerability did the attacker most likely exploit?
    1. Buffer overflow
    2. Session hijacking
    3. IP spoofing
    4. Open redirect
58. As a penetration tester, Max uses Wireshark to capture all of his testing traffic. Which of the following is not a reason that Max would capture packets during penetration tests?
    1. To document the penetration test
    2. To scan for vulnerabilities
    3. To gather additional information about systems and services
    4. To troubleshoot issues encountered when connecting to targets
59. Rich recently configured new vulnerability scans for his organization's business intelligence systems. The scans run late at night when users are not present. Rich received complaints from the business intelligence team that the performance burden imposed by the scanning is causing their overnight ETL jobs to run too slowly and they are not completing before business hours. How should Rich handle this situation?
    1. Rich should inform the team that they need to run the ETL jobs on a different schedule.
    2. Rich should reconfigure the scans to run during business hours.
    3. Rich should inform the team that they must resize the hardware to accommodate both requirements.
    4. Rich should work with the team to find a mutually acceptable solution.
60. Which one of the following regulations imposes compliance obligations specifically on financial institutions?
    1. SOX
    2. HIPAA
    3. PCI DSS
    4. GLBA
61. Bryce ran a vulnerability scan on his organization's wireless network and discovered that many employees are bringing their personally owned devices onto the corporate network (with permission) and those devices sometimes contain serious vulnerabilities. What mobile strategy is Bryce's organization using?
    1. COPE
    2. SAFE
    3. BYOD
    4. None of the above
62. Jamal uses the following command to mount a forensic image. What has he specified in his command?

            sansforensics@siftworkstation:~/Case1$ sudo mount RHINOUSB.dd /mnt/usb
            -t auto -o loop, noexec,ro

    1. He has mounted the file automatically, and it will not use any autorun files contained in the image.
    2. He has mounted the file with the filesystem type set to auto-recognize and has set the mount to act as a read-only loop device that will not execute files.
    3. He has mounted the file automatically and has set the mount to act as a read-only loop device that will not execute files.
    4. He has mounted the file with the filesystem type set to auto-recognize and has set it to act as a remote-only loop device that will not execute files.
63. Javier ran a vulnerability scan of a new web application created by developers on his team and received the report shown here. The developers inspected their code carefully and do not believe that the issue exists. They do have a strong understanding of SQL injection issues and have corrected similar vulnerabilities in other applications. What is the most likely scenario in this case?

    

    1. Javier misconfigured the scan.
    2. The code is deficient and requires correction.
    3. The vulnerability is in a different web application running on the same server.
    4. The result is a false positive.
64. Mateo is able to break into a host in a secured segment of a network during a penetration test. Unfortunately, the rules of engagement state that he is not allowed to install additional software on systems he manages to compromise. How can he use netcat to perform a port scan of other systems in the secured network segment?
    1. He can use the -sS option to perform a SYN scan.
    2. He can use the -z option to perform a scan.
    3. He can use the -s option to perform a scan.
    4. He can't; netcat is not a port scanner.
65. Which one of the following technologies allows the dynamic reprogramming of computer chips?
    1. TPM
    2. HSM
    3. eFuse
    4. UEFI
66. In his role as a security manager, Luis and a small team of experts have prepared a scenario for his security and system administration teams to use during their annual security testing. His scenario includes the rules that both the defenders and attackers must follow, as well as a scoring rubric that he will use to determine which team wins the exercise. What term should Luis use to describe his team's role in the exercise?
    1. White team
    2. Red team
    3. Gold team
    4. Blue team
67. Lauren downloads a new security tool and checks its MD5. What does she know about the software she downloaded if she receives the following message?

            root@demo:~# md5sum -c demo.md5
            demo.txt: FAILED
            md5sum: WARNING: 1 computed checksum did not match

    1. The file is corrupted.
    2. Attackers have modified the file.
    3. The files do not match.
    4. The test failed and provided no answer.
68. Martha ran a vulnerability scan against a series of endpoints on her network and received the vulnerability report shown here. She investigated further and found that several endpoints are running Internet Explorer 7. What is the minimum version level of IE that is considered secure?

    

    1. 7
    2. 9
    3. 11
    4. No version of Internet Explorer is considered secure.
69. During an incident investigation, Mateo is able to identify the IP address of the system that was used to compromise multiple systems belonging to his company. What can Mateo determine from this information?
    1. The identity of the attacker
    2. The country of origin of the attacker
    3. The attacker's domain name
    4. None of the above
70. Nick believes that an attacker has compromised a Linux workstation on his network and has added a new user. Unfortunately, most logging was not enabled on the system. Which of the following is most likely to provide useful information about which user was created most recently?
    1. /etc/passwd
    2. /var/log/auth.log
    3. Run ls -ld /home/$username for each user on the system
    4. Run ls -l /home/$username/.bash_logout to see the most recent logout time for each user on the system
71. After a major compromise involving what appears to be an APT, Jaime needs to conduct a forensic examination of the compromised systems. Which containment method should he recommend to ensure that he can fully investigate the systems that were involved while minimizing the risk to his organization's other production systems?
    1. Sandboxing
    2. Removal
    3. Isolation
    4. Segmentation
72. Piper is attempting to remediate a security vulnerability and must apply a patch to a production database server. The database administration team is concerned that the patch will disrupt business operations. How should Piper proceed?
    1. She should deploy the patch immediately on the production system.
    2. She should wait 60 days to deploy the patch to determine whether bugs are reported.
    3. She should deploy the patch in a sandbox environment to test it prior to applying it in production.
    4. She should contact the vendor to determine a safe timeframe for deploying the patch in production.
73. Kent ran a vulnerability scan of an internal CRM server that is routinely used by employees, and the scan reported that no services were accessible on the server. Employees continued to use the CRM application over the web without difficulty during the scan. What is the most likely source of Kent's result?
    1. The server requires strong authentication.
    2. The server uses encryption.
    3. The scan was run from a different network perspective than user traffic.
    4. The scanner's default settings do not check the ports used by the CRM application.
74. Steve needs to perform an nmap scan of a remote network and wants to be as stealthy as possible. Which of the following nmap commands will provide the stealthiest approach to his scan?
    1. nmap -P0 -sT 10.0.10.0/24
    2. nmap -sT -T0 10.0.10.0/24
    3. nmap -P0 -sS 10.0.10.0/24
    4. nmap -P0 -sS -T0 10.0.10.0/24
75. After performing threat hunting, Lakshman determines that it would be appropriate to disable some services on his organization's database servers. What activity is Lakshman engaging in?
    1. Establishing a hypothesis
    2. Gathering evidence
    3. Reducing the attack surface
    4. Executable process analysis
76. Jenna is configuring the scanning frequency for her organization's vulnerability scanning program. Which one of the following is the least important criteria for Jenna to consider?
    1. Sensitivity of information stored on systems
    2. Criticality of the business processes handled by systems
    3. Operating system installed on systems
    4. Exposure of the system to external networks
77. Donna is interpreting a vulnerability scan from her organization's network, shown here. She would like to determine which vulnerability to remediate first. Donna would like to focus on the most critical vulnerability according to the potential impact if exploited. Assuming the firewall is properly configured, which one of the following vulnerabilities should Donna give the highest priority?

    

    1. Severity 5 vulnerability in the file server
    2. Severity 3 vulnerability in the file server
    3. Severity 4 vulnerability in the web server
    4. Severity 2 vulnerability in the mail server
78. Which one of the following document categories provides the highest-level authority for an organization's cybersecurity program?
    1. Policy
    2. Standard
    3. Procedure
    4. Framework
79. Mateo is planning a vulnerability scanning program for his organization and is scheduling weekly scans of all the servers in his environment. He was approached by a group of system administrators who asked that they be given direct access to the scan reports without going through the security team. How should Mateo respond?
    1. Mateo should provide the administrators with access.
    2. Mateo should deny the administrators access because the information may reveal critical security issues.
    3. Mateo should offer to provide the administrators with copies of the report after they go through a security review.
    4. Mateo should deny the administrators access because it would allow them to correct security issues before they are analyzed by the security team.
80. During an incident investigation, Mateo discovers that attackers were able to query information about his routers and switches using SNMP. In addition, he discovers that the SNMP traffic was sent in plain text through his organization's network management backend network. Which version of SNMP would provide encryption and authentication features to help him prevent this in the future?
    1. SNMP v1
    2. SNMP v2
    3. SNMP v3
    4. SNMP v4
81. Which one of the following technologies promises to provide automated insight into security data?
    1. Machine learning
    2. Data enrichment
    3. Continuous integration
    4. Continuous delivery
82. While reviewing a report from a vulnerability scan of a web server, Paul encountered the vulnerability shown here. What is the easiest way for Paul to correct this vulnerability with minimal impact on the business?

    

    1. Block ports 80 and 443.
    2. Adjust directory permissions.
    3. Block port 80 only to require the use of encryption.
    4. Remove CGI from the server.
83. A log showing a successful user authentication is classified as what type of occurrence in NIST's definitions?
    1. A security incident
    2. A security event
    3. An event
    4. An adverse event
84. Mei used the dig command to attempt to look up the IP address for CompTIA's website and received the results shown here. What can Mei conclude from these results?

    

    1. CompTIA's website is located at 198.134.5.6.
    2. CompTIA's website is located at 172.30.0.2.
    3. CompTIA's website is currently down.
    4. The DNS search failed, but you cannot draw any conclusions about the website.
85. Fran is trying to run a vulnerability scan of a web server from an external network, and the scanner is reporting that there are no services running on the web server. She verified the scan configuration and attempted to access the website running on that server using a web browser on a computer located on the same external network and experienced no difficulty. What is the most likely issue with the scan?
    1. A host firewall is blocking access to the server.
    2. A network firewall is blocking access to the server.
    3. An intrusion prevention system is blocking access to the server.
    4. Fran is scanning the wrong IP address.