While reviewing network flow logs, John sees that network flow on a particular segment suddenly dropped to zero. What is the most likely cause of this?
A denial-of-service attack
A link failure
High bandwidth consumption
Beaconing
Saanvi is conducting the recovery process after his organization experienced a security incident. During that process, he plans to apply patches to all of the systems in his environment. Which one of the following should be his highest priority for patching?
Windows systems
Systems involved in the incident
Linux systems
Web servers
Susan's organization suffered from a major breach that was attributed to an advanced persistent threat (APT) that used exploits of zero-day vulnerabilities to gain control of systems on her company's network. Which of the following is the least appropriate solution for Susan to recommend to help prevent future attacks of this type?
Heuristic attack detection methods
Signature-based attack detection methods
Segmentation
Leverage threat intelligence
During his investigation of a Windows system, Eric discovered that files were deleted and he wants to determine whether a specific file previously existed on the computer. Which of the following is the least likely to be a potential location to discover evidence supporting that theory?
Windows registry
Master File Table
INDX files
Event logs
As part of her SOC analyst duties, Emily is tasked with monitoring intrusion detection systems that cover her employer's corporate headquarters network. During her shift, Emily's IDS alarms report that a network scan has occurred from a system with IP address 10.0.11.19 on the organization's WPA3 Enterprise wireless network aimed at systems in the finance division. What data source should she check first?
Host firewall logs
AD authentication logs
Wireless authentication logs
WAF logs
Casey's incident response process leads her to a production server that must stay online for her company's business to remain operational. What method should she use to capture the data she needs?
Live image to an external drive.
Live image to the system's primary drive.
Take the system offline and image to an external drive.
Take the system offline, install a write blocker on the system's primary drive, and then image it to an external drive.
What does the Nmap response “filtered” mean in port scan results?
Nmap cannot tell whether the port is open or closed.
A firewall was detected.
An IPS was detected.
There is no application listening, but there may be one at any time.
During her review of incident logs, Deepa discovers the initial entry via SSH on a front-facing bastion host (A) at 8:02 a.m. If the network that Deepa is responsible for is designed as shown here, what is the most likely diagnosis if the second intrusion shows up on host B at 7:15 a.m.?
Internal host B was previously compromised.
Host A was compromised; then host B was compromised.
Neither host B nor host A are synchronized to NTP properly.
An internal threat compromised host B and then host A.
Matt recently ran a vulnerability scan of his organization's network and received the results shown here. He would like to remediate the server with the highest number of the most serious vulnerabilities first. Which one of the following servers should be on his highest priority list?
Server A
Server B
Server C
Server D
Saanvi has been tasked with conducting a risk assessment for the midsize bank that he works at because of a recent compromise of their online banking web application. Saanvi has chosen to use the NIST 800-30 risk assessment framework shown here. What likelihood of occurrence should he assign to breaches of the web application?
Low
Medium
High
Cannot be determined from the information given
Hank's boss recently came back from a CEO summit event where he learned about the importance of cybersecurity and the role of vulnerability scanning. He asked Hank about the vulnerability scans conducted by the organization and suggested that instead of running weekly scans that they simply configure the scanner to start a new scan immediately after the prior scan completes. How should Hank react to this request?
Hank should inform the CEO that this would have a negative impact on system performance and is not recommended.
Hank should immediately implement the CEO's suggestion.
Hank should consider the request and work with networking and engineering teams on possible implementation.
Hank should inform the CEO that there is no incremental security benefit from this approach and that he does not recommend it.
Selah's organization suffers an outage of its point-to-point encrypted VPN because of a system compromise at its ISP. What type of issue is this?
Confidentiality
Availability
Integrity
Accountability
Garrett is working with a database administrator to correct security issues on several servers managed by the database team. He would like to extract a report for the DBA that will provide useful information to assist in the remediation effort. Of the report templates shown here, which would be most useful to the DBA team?
Qualys Top 20 Report
Payment Card Industry (PCI) Technical Report
Executive Report
Technical Report
Jiang's SolarWinds network monitoring tools provide data about a system hosted in Amazon's AWS environment. When Jiang checks his server's average response time, he sees the results shown here.
What action should Jiang take based on this information?
He should increase the speed of his network link.
He should check for scheduled tasks at the times he sees spikes.
He should ensure that his network card has the proper latency settings.
He should perform additional diagnostics to determine the cause of the latency.
Alex notices the traffic shown here during a Wireshark packet capture. What is the host with IP address 10.0.2.11 most likely doing?
UDP-based port scanning
Network discovery via TCP
SYN-based port scanning
DNS-based discovery
Jake is building a forensic image of a compromised drive using the dd command with its default settings. He finds that the imaging is going very slowly. What parameter should he adjust first?
if
bs
of
count
What purpose does a honeypot system serve when placed on a network as shown here?
It prevents attackers from targeting production servers.
It provides information about the techniques attackers are using.
It slows down attackers like sticky honey.
It provides real-time input to IDSs and IPSs.
Munju's security team has found consistent evidence of system compromise over a period of weeks, with additional evidence pointing to the systems they are investigating being compromised for years. Despite her team's best efforts, Munju has found that her team cannot seem to track down and completely remove the compromise. What type of attack is Munju likely dealing with?
A Trojan horse
An APT
A rootkit
A zero-day attack
Which one of the following metrics would be most useful in determining the effectiveness of a vulnerability remediation program?
Number of critical vulnerabilities resolved
Time to resolve critical vulnerabilities
Number of new critical vulnerabilities per month
Time to complete vulnerability scans
Mike's Nmap scan of a system using the command nmap 192.168.1.100 does not return any results. What does Mike know about the system if he is sure of its IP address, and why?
The system is not running any open services.
All services are firewalled.
There are no TCP services reachable on Nmap's default 1000 TCP ports.
There are no TCP services reachable on Nmap's default 65535 TCP ports.
What is the purpose of creating a hash value for a drive during the forensic imaging process?
To prove that the drive's contents were not altered
To prove that no data was deleted from the drive
To prove that no files were placed on the drive
All of the above
After completing his unsuccessful forensic analysis of the hard drive from a workstation that was compromised by malware, Ben sends it to be re-imaged and patched by his company's desktop support team. Shortly after the system returns to service, the device once again connects to the same botnet. What action should Ben take as part of his next forensic review if this is the only system showing symptoms like this?
Verify that all patches are installed.
Destroy the system.
Validate the BIOS hash against a known good version.
Check for a system with a duplicate MAC address.
Part of the forensic data that Susan was provided for her investigation was a Wireshark packet capture. The investigation is aimed at determining what type of media an employee was consuming during work. What is the more detailed analysis that Susan can do if she is provided with the data shown here?
She can determine that the user was viewing a GIF.
She can manually review the TCP stream to see what data was sent.
She can export and view the GIF.
She cannot determine what media was accessed using this data set.
Which one of the following models traces the steps that an attacker would commonly perform during an intrusion?
MITRE ATT&CK
Diamond
Cyber Kill Chain
STIX
Mika wants to run an Nmap scan that includes all TCP ports and uses service detection. Which of the following nmap commands should she execute?
nmap -p0 -all -SC
nmap -p 1-32768 -sVS
nmap -p 1-65535 -sV -sS
nmap -all -sVS
Which one of the following cloud service models relies on the cloud service provider to implement the greatest number of security controls?
SaaS
PaaS
FaaS
IaaS
Dan is a cybersecurity analyst for a healthcare organization. He ran a vulnerability scan of the VPN server used by his organization. His scan ran from inside the datacenter against a VPN server also located in the datacenter. The complete vulnerability report is shown here. What action should Dan take next?
Dan should immediately remediate this vulnerability.
Dan should schedule the vulnerability for remediation within the next 30 days.
Dan should rerun the scan because this is likely a false positive report.
Dan should take no action.
Kwame received an alert from his organization's SIEM that it detected a potential attack against a web server on his network. However, he is unsure whether the traffic generating the alert actually entered the network from an external source or whether it came from inside the network. The NAT policy at the network perimeter firewall rewrites public IP addresses, making it difficult to assess this information based on IP addresses. Kwame would like to perform a manual log review to locate the source of the traffic. Where should he turn for the best information?
Application server logs
Database server logs
Firewall logs
Antimalware logs
Which one of the following types of vulnerability scans would provide the least information about the security configuration of a system?
Agent-based scan
Credentialed scan
Uncredentialed internal scan
Uncredentialed external scan
After finishing a forensic case, Sam needs to wipe a magnetic hard drive (HDD) that he is using to prepare it for the next case. Which of the following methods is best suited to preparing the hard drive that he will use if he wants to be in compliance with NIST SP 800-88?
Degauss the drive.
Zero-write the drive.
Seven rounds: all ones, all zeros, and five rounds of random values.
Use the ATA Secure Erase command.
After reading the NIST standards for incident response, Mateo spends time configuring the NTP service on each of his servers, workstations, and appliances throughout his network. What phase of the incident response process is he working to improve?
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident activity
Latisha is the ISO for her company and is notified that a zero-day exploit has been released that can result in remote code execution on all Windows workstations on her network because of an attack against Windows domain services. She wants to limit her exposure to this exploit but needs the systems to continue to be able to access the Internet. Which of the following approaches is best for her response?
Firewalling
Patching
Isolation
Segmentation
When Saanvi was called in to help with an incident recovery effort, he discovered that the network administrator had configured the network as shown here. What type of incident response action best describes what Saanvi has encountered?
Segmentation
Isolation
Removal
Network locking
As part of the forensic investigation of a Linux workstation, Alex needs to determine what commands may have been issued on the system. If no anti-forensic activities have taken place, what is the best location for Alex to check for a history of commands issued on the system?
/var/log/commands.log
$HOME/.bash_history
$HOME/.commands.sqlite
/var/log/authactions.log
Ben recently completed a risk analysis and determined that he should implement a new set of firewall rules to filter traffic from known suspect IP addresses. What type of risk management activity is he performing?
Risk avoidance
Risk acceptance
Risk transference
Risk mitigation
Crystal is attempting to determine the next task that she should take on from a list of security priorities. Her boss told her that she should focus on activities that have the most “bang for the buck.” Of the tasks shown here, which should she tackle first?
Task 1
Task 2
Task 3
Task 4
During the analysis of an incident that took place on her network, Sofia discovered that the attacker used a stolen cookie to access a web application. Which one of the following attack types most likely occurred?
On-path (man-in-the-middle)
Privilege escalation
Cross-site scripting
Session hijacking
Curt is conducting a forensic analysis of a Windows system and needs to determine whether a program was set to automatically run. Which of the following locations should he check for this information?
NTFS INDX files
The registry
Event logs
Prefetch files
What concept measures how easy data is to lose?
Order of volatility
Data transience
Data loss prediction
The Volatility Framework
Steps like those listed here are an example of what type of incident response preparation?
Visit otx.alienvault.com and the suspected C&C system's IP address on the top search input field.
If the IP address is associated with malware C&C activity, create a ticket in the incident response tracking system.
Creating a CSIRT
Creating a playbook
Creating an incident response plan
Creating an IR-FAQ
While analyzing the vulnerability scan from her web server, Kristen discovers the issue shown here. Which one of the following solutions would best remedy the situation?
Move from TLS 1.0 to SSL 3.0.
Require IPsec connections to the server.
Disable the use of TLS.
Move from TLS 1.0 to TLS 1.3.
Charles is building an incident response playbook for his organization that will address command-and-control client-server traffic detection and response. Which of the following information sources is least likely to be part of his playbook?
DNS query logs
Threat intelligence feeds
Honeypot data
Notifications from internal staff about suspicious behavior
Carol recently fell victim to a phishing attack. When she clicked the link in an email message that she received, she was sent to her organization's central authentication service and logged in successfully. She did verify the URL and certificate to validate that the authentication server was genuine. After authenticating, she was sent to a form that collected sensitive personal information that was sent to an attacker. What type of vulnerability did the attacker most likely exploit?
Buffer overflow
Session hijacking
IP spoofing
Open redirect
As a penetration tester, Max uses Wireshark to capture all of his testing traffic. Which of the following is not a reason that Max would capture packets during penetration tests?
To document the penetration test
To scan for vulnerabilities
To gather additional information about systems and services
To troubleshoot issues encountered when connecting to targets
Rich recently configured new vulnerability scans for his organization's business intelligence systems. The scans run late at night when users are not present. Rich received complaints from the business intelligence team that the performance burden imposed by the scanning is causing their overnight ETL jobs to run too slowly and they are not completing before business hours. How should Rich handle this situation?
Rich should inform the team that they need to run the ETL jobs on a different schedule.
Rich should reconfigure the scans to run during business hours.
Rich should inform the team that they must resize the hardware to accommodate both requirements.
Rich should work with the team to find a mutually acceptable solution.
Javier ran a vulnerability scan of a new web application created by developers on his team and received the report shown here. The developers inspected their code carefully and do not believe that the issue exists. They do have a strong understanding of SQL injection issues and have corrected similar vulnerabilities in other applications. What is the most likely scenario in this case?
Javier misconfigured the scan.
The code is deficient and requires correction.
The vulnerability is in a different web application running on the same server.
The result is a false positive.
During an incident investigation, Mateo is able to identify the IP address of the system that was used to compromise multiple systems belonging to his company. What can Mateo determine from this information?
The identity of the attacker
The country of origin of the attacker
The attacker's domain name
None of the above
After a major compromise involving what appears to be an APT, Jaime needs to conduct a forensic examination of the compromised systems. Which containment method should he recommend to ensure that he can fully investigate the systems that were involved while minimizing the risk to his organization's other production systems?
Sandboxing
Removal
Isolation
Segmentation
Piper is attempting to remediate a security vulnerability and must apply a patch to a production database server. The database administration team is concerned that the patch will disrupt business operations. How should Piper proceed?
She should deploy the patch immediately on the production system.
She should wait 60 days to deploy the patch to determine whether bugs are reported.
She should deploy the patch in a sandbox environment to test it prior to applying it in production.
She should contact the vendor to determine a safe time frame for deploying the patch in production.
Kent ran a vulnerability scan of an internal CRM server that is routinely used by employees, and the scan reported that no services were accessible on the server. Employees continued to use the CRM application over the Web without difficulty during the scan. What is the most likely source of Kent's result?
The server requires strong authentication.
The server uses encryption.
The scan was run from a different network perspective than user traffic.
The scanner's default settings do not check the ports used by the CRM application.
Steve needs to perform an Nmap scan of a remote network and wants to be as stealthy as possible. Which of the following nmap commands will provide the stealthiest approach to his scan?
nmap -P0 -sT 10.0.10.0/24
nmap -sT -T0 10.0.10.0/24
nmap -P0 -sS 10.0.10.0/24
nmap -P0 -sS -T0 10.0.10.0/24
After performing threat hunting, Lakshman determines that it would be appropriate to disable some services on his organization's database servers. What activity is Lakshman engaging in?
Establishing a hypothesis
Gathering evidence
Reducing the attack surface
Executable process analysis
Jenna is configuring the scanning frequency for her organization's vulnerability scanning program. Which one of the following is the least important criteria for Jenna to consider?
Sensitivity of information stored on systems
Criticality of the business processes handled by systems
Operating system installed on systems
Exposure of the system to external networks
Donna is interpreting a vulnerability scan from her organization's network, shown here. She would like to determine which vulnerability to remediate first. Donna would like to focus on the most critical vulnerability according to the potential impact if exploited. Assuming the firewall is properly configured, which one of the following vulnerabilities should Donna give the highest priority?
Severity 5 vulnerability in the file server
Severity 3 vulnerability in the file server
Severity 4 vulnerability in the web server
Severity 2 vulnerability in the mail server
Which one of the following document categories provides the highest-level authority for an organization's cybersecurity program?
Policy
Standard
Procedure
Framework
Mateo is planning a vulnerability scanning program for his organization and is scheduling weekly scans of all the servers in his environment. He was approached by a group of system administrators who asked that they be given direct access to the scan reports without going through the security team. How should Mateo respond?
Mateo should provide the administrators with access.
Mateo should deny the administrators access because the information may reveal critical security issues.
Mateo should offer to provide the administrators with copies of the report after they go through a security review.
Mateo should deny the administrators access because it would allow them to correct security issues before they are analyzed by the security team.
While reviewing a report from a vulnerability scan of a web server, Paul encountered the vulnerability shown here. What is the easiest way for Paul to correct this vulnerability with minimal impact on the business?
Block ports 80 and 443.
Adjust directory permissions.
Block port 80 only to require the use of encryption.
Remove CGI from the server.
A log showing a successful user authentication is classified as what type of occurrence in NIST's definitions?
A security incident
A security event
An event
An adverse event
Fran is trying to run a vulnerability scan of a web server from an external network, and the scanner is reporting that there are no services running on the web server. She verified the scan configuration and attempted to access the website running on that server using a web browser on a computer located on the same external network and experienced no difficulty. What is the most likely issue with the scan?
A host firewall is blocking access to the server.
A network firewall is blocking access to the server.
An intrusion prevention system is blocking access to the server.
Fran is scanning the wrong IP address.
During a regulatory compliance assessment, Manish discovers that his organization has implemented a multifactor authentication requirement for systems that store and handle highly sensitive data. The system requires that users provide both a password and a four-digit PIN. What should Manish note in his findings about this system?
The multifactor system provides two independent factors and provides an effective security control.
The factors used are both the same type of factor, making the control less effective.
The system uses only two factors and is not a true multifactor system. To qualify as multifactor, it should include at least three factors.
The multifactor system's use of a four-digit PIN does not provide sufficient complexity, and additional length should be required for any PIN for secure environments.
Which one of the following mechanisms may be used to enhance security in a context-based authentication system?
Time of day
Location
Device fingerprint
All of the above
Latisha's organization has faced a significant increase in successful phishing attacks, resulting in compromised accounts. She knows that she needs to implement additional technical controls to prevent successful attacks. Which of the following controls will be the most effective while remaining relatively simple and inexpensive to deploy?
Increased password complexity requirements
Application or token-based multifactor authentication
Biometric-based multifactor authentication
OAuth-based single sign-on
Lauren downloads a new security tool and checks its MD5. What does she know about the software she downloaded if she receives the following message?
root@demo:~# md5sum -c demo.md5 demo.txt: FAILED md5sum: WARNING: 1 computed checksum did not match
The file is corrupted.
Attackers have modified the file.
The files do not match.
The test failed and provided no answer.
Peter works for an organization that is joining a consortium of similar organizations that use a federated identity management (FIM) system. He is configuring his identity management system to participate in the federation. Specifically, he wants to ensure that users at his organization will be able to use their credentials to access federated services. What role is Peter configuring?
Relying party
Service provider
Identity provider
Consumer
Mika uses a security token like the unit shown here and a password to authenticate to her PayPal account. What two types of factors is she using?
Something she knows and something she has.
Something she knows and something she is.
Something she is and something she has.
Mika is using only one type of factor because she knows the token code and her password.
During the account setup for her bank, Deepa is asked to answer a series of questions about her past home addresses, financial transactions, and her credit history. What type of authentication factor is Deepa being asked for?
Location factor
Knowledge factor
Possession factor
Biometric factor
Charles is worried about users conducting SQL injection attacks. Which of the following solutions will best address his concerns?
Using secure session management
Enabling logging on the database
Performing user input validation
Implementing TLS
Which of the following risks is most commonly associated with vulnerability scanning activities?
Attackers may learn about the vulnerabilities.
Services may be crashed by the scanner.
The vulnerability scanner may be exploited by attackers.
Too many vulnerabilities may be detected.
Adam finds entries in his authentication logs for many of the systems in his network that all have logins for the same userID with a variety of passwords. What type of attack has he discovered?
A session hijacking attack
An on-path (man-in-the-middle) attack
A credential stuffing attack
A password spraying attack
You are reviewing the methods that your organization uses to communicate with the media during an incident response effort. Which one of the following is not a commonly accepted practice?
Inform the media immediately of developments in the investigation.
Conduct practice sessions for incident responders who communicate with the media.
Establish media briefing procedures in advance of an incident.
Maintain an incident response status document.
Charles reviews the source code for a web application for vulnerabilities. What type of software assessment is this?
Dynamic analysis
Fuzzing
Static analysis
Reverse engineering
Isaac sees the following entry in his web logs. What type of attack has been attempted?
http://example.com/../../../../../etc/shadow
A buffer overflow attack
An attack on the heap
A session hijacking attack
A directory traversal attack
Precompiled SQL statements that only require variables to be input are an example of what type of application security control?
Parameterized queries
Encoding data
Input validation
Appropriate access controls
Rob would like to perform a root-cause analysis in the wake of an incident. He will be including the results of that analysis in his incident report. What action should he take first?
Document the analysis.
Differentiate between each of the events and causal factors.
Identify the problems and events that occurred.
Establish a timeline.
What are activities like disabling unnecessary processes, moving systems to internal IP addresses, and using firewalls and other network security devices to protect hosts known as in the context of threat hunting?
Establishing a hypothesis
Conducting a security lockdown
Reducing the attack surface areas
Bundling critical assets
Bob is creating a report to management summarizing the result of a recent vulnerability scan. He would like to prioritize the results. Which one of the following tools would provide the most comprehensive assessment of the risk posed by each vulnerability?
CVSS score
Confidentiality rating
Impact rating
Likelihood rating
Kelly's organization recently suffered a security incident where the attacker was present on her network for several months before the SOC identified the attack. Once they saw evidence, they quickly reacted to contain the incident. Which incident response metric would suffer most as a result of this performance?
Mean time to respond
Mean time to remediate
Alert volume
Mean time to detect
Seth is trying to identify activities in his organization that might be automated to improve efficiency. Which one of the following activities is least likely to benefit from automation?
Threat hunting
Intrusion analysis
Qualitative risk assessment
Data backup
Rae wants to detect forged sender addresses to decrease the amount of spam that her organization receives. Which of the following techniques or methods will most directly fit her needs?
Spamhaus
DKIM
SPF
RBL
Your organization recently suffered a series of serious vulnerabilities as a result of the use of legacy software that is no longer supported by the vendor. This software is critical to your organization and can't be removed for at least six more months. What action plan would best address this risk during that six month period?
Awareness, training, and education
Compensating controls
Patch management
Changing business requirements
Yolanda received a threat intelligence report and is evaluating it to determine whether her organization runs any of the software affected by the threat. What type of confidence is Yolanda attempting to gain?
Timeliness
Accuracy
Relevancy
Superficial
Gabby's organization captures sensitive customer information, and salespeople and others often work with that data on local workstations and laptops. After a recent inadvertent breach where a salesperson accidentally sent a spreadsheet of customer information to another customer, her organization is seeking a technology solution that can help prevent similar problems. What should Gabby recommend?
IDS
FSB
DLP
FDE
Fred is reviewing a checklist used in the automation of his security program and sees the following code:
What file type from the following list is he most likely reviewing?
Plaintext
JSON
XML
HTML
Cynthia's organization receives a letter from a company they are a service provider for, notifying them of a pending legal case and telling them not to delete or discard documents related to the case. What term describes this?
Legal hold
Litigation priority
Criminal suspension
A data summons
As part of his forensic investigation, Alex signs and notes in his log when the drive copy he prepared is transferred to legal counsel. What is this process known as?