Improve Your Knowledge with CAS-004 Exam Dumps

1. An organization is developing a disaster recovery plan that requires data to be backed up and available at a moment’s notice.

Which of the following should the organization consider FIRST to address this requirement?

2. A company has a BYOD policy and has configured remote-wiping capabilities to support security requirements. An executive has raised concerns about personal contacts and photos being deleted from personal devices when an employee is terminated.

Which of the following is the best way to address these concerns?

3. A developer needs to implement PKI in an autonomous vehicle's software in the most efficient and labor-effective way possible.

Which of the following will the developer MOST likely implement?

4. A security analyst is investigating a possible buffer overflow attack.

The following output was found on a user’s workstation:

graphic.linux_randomization.prg

Which of the following technologies would mitigate the manipulation of memory segments?

5. A security analyst wants to keep track of alt outbound web connections from workstations. The analyst's company uses an on-premises web filtering solution that forwards the outbound traffic to a perimeter firewall. When the security analyst gets the connection events from the firewall, the source IP of the outbound web traffic is the translated IP of the web filtering solution. Considering this scenario involving source NAT.

Which of the following would be the BEST option to inject in the HTTP header to include the real source IP from workstations?

6. A company that provides services to clients who work with highly sensitive data would like to provide assurance that the data’s confidentiality is maintained in a dynamic, low-risk environment.

Which of the following would best achieve this goal? (Select two).

7. A company is looking for a solution to hide data stored in databases.

The solution must meet the following requirements:

Be efficient at protecting the production environment

Not require any change to the application

Act at the presentation layer

Which of the following techniques should be used?

8. A security architect is tasked with securing a new cloud-based videoconferencing and collaboration platform to support a new distributed workforce.

The security architect's key objectives are to:

• Maintain customer trust

• Minimize data leakage

• Ensure non-repudiation

Which of the following would be the BEST set of recommendations from the security architect?

9. A software development company makes Its software version available to customers from a web portal. On several occasions, hackers were able to access the software repository to change the package that is automatically published on the website.

Which of the following would be the BEST technique to ensure the software the users download is the official software released by the company?

10. An ASIC manufacturer wishing to best reduce downstream supply chain risk can provide validation instructions for consumers that:

11. Which of the following is record-level encryption commonly used to do?

12. A disaster recovery team learned of several mistakes that were made during the last disaster recovery parallel test. Computational resources ran out at 70% of restoration of critical services.

Which of the following should be modified to prevent the issue from reoccurring?

13. Which of the following is the MOST important security objective when applying cryptography to control messages that tell an ICS how much electrical power to output?

14. A company wants to refactor a monolithic application to take advantage of cloud native services and service micro segmentation to secure sensitive application components.

Which of the following should the company implement to ensure the architecture is portable?

15. The Chief Information Security Officer (CISO) asked a security manager to set up a system that sends an alert whenever a mobile device enters a sensitive area of the company's data center. The CISO would also like to be able to alert the individual who is entering the area that the access was logged and monitored.

Which of the following would meet these requirements?

16. A mobile application developer is creating a global, highly scalable, secure chat application. The developer would like to ensure the application is not susceptible to on-path attacks while the user is traveling in potentially hostile regions.

Which of the following would BEST achieve that goal?

17. An HVAC contractor requested network connectivity permission to remotely support/troubleshoot

equipment issues at a company location. Currently, the company does not have a process that allows vendors remote access to the corporate network

Which of the following solutions represents the BEST course of action to allow the contractor access?

18. A systems administrator is in the process of hardening the host systems before connecting to the network. The administrator wants to add protection to the boot loader to ensure the hosts are secure before the OS fully boots.

Which of the following would provide the BEST boot loader protection?

19. Which of the following indicates when a company might not be viable after a disaster?

20. An organization developed a social media application that is used by customers in multiple remote geographic locations around the world. The organization’s headquarters and only datacenter are located in New York City.

The Chief Information Security Officer wants to ensure the following requirements are met for the social media application:

Low latency for all mobile users to improve the users’ experience

SSL offloading to improve web server performance

Protection against DoS and DDoS attacks

High availability

Which of the following should the organization implement to BEST ensure all requirements are met?

21. A systems administrator at a web-hosting provider has been tasked with renewing the public certificates of all customer sites.

Which of the following would BEST support multiple domain names while minimizing the amount of certificates needed?

22. A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log.

Which of the following actions would BEST address the potential risks by the activity in the logs?

23. While investigating a security event, an analyst finds evidence that a user opened an email attachment from an unknown source. Shortly after the user opened the attachment, a group of servers experienced a large amount of network and resource activity. Upon investigating the servers, the analyst discovers the servers were encrypted by ransomware that is demanding payment within 48 hours or all data will be destroyed. The company has no response plans for ransomware.

Which of the following is the NEXT step the analyst should take after reporting the incident to the management team?

24. The security analyst discovers a new device on the company’s dedicated loT subnet during the most recent vulnerability scan. The scan results show numerous open ports and insecure protocols in addition to default usernames and passwords. A camera needs to transmit video to the security server in the loT subnet.

Which of the following should the security analyst recommend to securely operate the camera?

25. The information security manager at a 24-hour manufacturing facility is reviewing a contract for potential risks to the organization. The contract pertains to the support of printers and multifunction devices during non-standard business hours.

Which of the following will the security manager most likely identify as a risk?

26. An organization is researching the automation capabilities for systems within an OT network. A security analyst wants to assist with creating secure coding practices and would like to learn about the programming languages used on the PLCs.

Which of the following programming languages is the MOST relevant for PLCs?

27. A software company wants to build a platform by integrating with another company's established product.

Which of the following provisions would be MOST important to include when drafting an agreement between the two companies?

28. An organization is moving its intellectual property data from on premises to a CSP and wants to secure the data from theft.

Which of the following can be used to mitigate this risk?

29. A pharmaceutical company was recently compromised by ransomware.

Given the following EDR output from the process investigation:





On which of the following devices and processes did the ransomware originate?

30. In comparison with traditional on-premises infrastructure configurations, defining ACLs in a CSP relies on:

31. Users are reporting intermittent access issues with a new cloud application that was recently added to the network. Upon investigation, the security administrator notices the human resources department is able to run required queries with the new application, but the marketing department is unable to pull any needed reports on various resources using the new application.

Which of the following MOST likely needs to be done to avoid this in the future?

32. A systems engineer needs to develop a solution that uses digital certificates to allow authentication to laptops.

Which of the following authenticator types would be most appropriate for the engineer to include in the design?

33. During the development process, the team identifies major components that need to be rewritten. As a result, the company hires a security consultant to help address major process issues.

Which of the following should the consultant recommend to best prevent these issues from reoccurring in the future?

34. A software development company is building a new mobile application for its social media platform. The company wants to gain its users' trust by re reducing the risk of on-path attacks between the mobile client and its servers and by implementing stronger digital trust.

To support users’ trust, the company has released the following internal guidelines:

* Mobile clients should verify the identity of all social media servers locally.

* Social media servers should improve TLS performance of their certificate status.

+ Social media servers should inform the client to only use HTTPS.

Given the above requirements, which of the following should the company implement? (Select TWO).

35. A hospital has fallen behind with patching known vulnerabilities due to concerns that patches may cause disruptions in the availability of data and impact patient care. The hospital does not have a tracking solution in place to audit whether systems have been updated or to track the length of time between notification of the weakness and patch completion Since tracking is not in place the hospital lacks accountability with regard to who is responsible for these activities and the timeline of patching efforts.

Which of the following should the hospital do first to mitigate this risk?

36. An application developer is including third-party background security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is released to the public, report come In that a previously vulnerability has returned.

Which of the following should the developer integrate into the process to BEST prevent this type of behavior?

37. An loT device implements an encryption module built within its SoC where the asymmetric private key has been defined in a write-once read-many portion of the SoC hardware.

Which of the following should the loT manufacture do if the private key is compromised?

38. A Chief Information Officer (CIO) wants to implement a cloud solution that will satisfy the following requirements:

Support all phases of the SDLC.

Use tailored website portal software.

Allow the company to build and use its own gateway software.

Utilize its own data management platform.

Continue using agent-based security tools.

Which of the following cloud-computing models should the CIO implement?

39. A company has been the target of LDAP injections, as well as brute-force, whaling, and spear-phishing attacks. The company is concerned about ensuring continued system access. The company has already implemented a SSO system with strong passwords.

Which of the following additional controls should the company deploy?

40. A networking team was asked to provide secure remote access to all company employees. The team decided to use client-to-site VPN as a solution. During a discussion, the Chief Information Security Officer raised a security concern and asked the networking team to route the Internet traffic of remote users through the main office infrastructure. Doing this would prevent remote users from accessing the Internet through their local networks while connected to the VPN.

Which of the following solutions does this describe?

41. A cloud security architect has been tasked with finding a solution for hardening VMS.

The solution must meet the following requirements:

• Data needs to be stored outside of the VMS.

• No unauthorized modifications to the VMS are allowed

• If a change needs to be done, a new VM needs to be deployed.

Which of the following is the BEST solution?

42. A security engineer is re-architecting a network environment that provides regional electric distribution services.

During a pretransition baseline assessment, the engineer identified the following security-relevant characteristics of the environment:

• Enterprise IT servers and supervisory industrial systems share the same subnet.

• Supervisory controllers use the 750MHz band to direct a portion of fielded PLCs.

• Command and telemetry messages from industrial control systems are unencrypted and unauthenticated.

Which of the following re-architecture approaches would be best to reduce the company's risk?

43. A help desk technician just informed the security department that a user downloaded a suspicious file from internet explorer last night. The user confirmed accessing all the files and folders before going home from work. the next morning, the user was no longer able to boot the system and was presented a screen with a phone number. The technician then tries to boot the computer using wake-on-LAN, but the system would not come up.

Which of the following explains why the computer would not boot?

44. A junior developer is informed about the impact of new malware on an Advanced RISC Machine (ARM) CPU, and the code must be fixed accordingly. Based on the debug, the malware is able to insert itself in another process ‘memory location.

Which of the following technologies can the developer enable on the ARM architecture to prevent this type of malware?

45. The general counsel at an organization has received written notice of upcoming litigation. The general counsel has issued a legal records hold.

Which of the following actions should the organization take to comply with the request?

46. A company wants to prevent a partner company from denying agreement to a transaction.

Which of the following is the best solution for the company?

47. Which of the following describes how a risk assessment is performed when an organization has a critical vendor that provides multiple products?

48. A company purchased Burp Suite licenses this year for each application security engineer. The engineers have used Burp Suite to identify several issues with the company’s SaaS application. In the upcoming year, the Chief Information Security Officer would like to purchase additional tools to protect the SaaS product.

Which of the following is the best option?

49. An organization developed a containerized application. The organization wants to run the application in the cloud and automatically scale it based on demand. The security operations team would like to use container orchestration but does not want to assume patching responsibilities.

Which of the following service models best meets these requirements?

50. A user experiences an HTTPS connection error when trying to access an Internet banking website from a corporate laptop. The user then opens a browser on a mobile phone and is able to access the same Internet banking website without issue.

Which of the following security configurations is MOST likely the cause of the error?

51. An organization is considering a BYOD standard to support remote working. The first iteration of the solution will utilize only approved collaboration applications and the ability to move corporate data between those applications.

The security team has concerns about the following:

Unstructured data being exfiltrated after an employee leaves the organization

Data being exfiltrated as a result of compromised credentials

Sensitive information in emails being exfiltrated

Which of the following solutions should the security team implement to mitigate the risk of data loss?

52. A security consultant is designing an infrastructure security solution for a client company that has provided the following requirements:

• Access to critical web services at the edge must be redundant and highly available.

• Secure access services must be resilient to a proprietary zero-day vulnerability in a single component.

• Automated transition of secure access solutions must be able to be triggered by defined events or manually by security operations staff.

Which of the following solutions BEST meets these requirements?

53. An organization wants to perform a scan of all its systems against best practice security configurations.

Which of the following SCAP standards, when combined, will enable the organization to view each of the configuration checks in a machine-readable checklist format for fill automation? (Choose two.)

54. A security engineer is assessing the security controls of loT systems that are no longer supported for updates and patching.

Which of the following is the best mitigation for defending these loT systems?

55. A cybersecurity analyst receives a ticket that indicates a potential incident is occurring. There has been a large in log files generated by a generated by a website containing a ‘’Contact US’’ form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign of if this is a potential incident.

Which of the following would BEST assist the analyst?

56. A security analyst needs to recommend a remediation to the following threat:





Which of the following actions should the security analyst propose to prevent this successful exploitation?

57. SIMULATION

A security engineer needs to review the configurations of several devices on the network to meet the following requirements:

• The PostgreSQL server must only allow connectivity in the 10.1.2.0/24 subnet.

• The SSH daemon on the database server must be configured to listen to port 4022.

• The SSH daemon must only accept connections from a Single workstation.

• All host-based firewalls must be disabled on all workstations.

• All devices must have the latest updates from within the past eight days.

• All HDDs must be configured to secure data at rest.

• Cleartext services are not allowed.

• All devices must be hardened when possible.

Instructions:

Click on the various workstations and network devices to review the posture assessment results.

Remediate any possible issues or indicate that no issue is found.

Click on Server A to review output data. Select commands in the appropriate tab to remediate connectivity problems to the pOSTGREsql

DATABASE VIA ssh





WAP A





PC A





Laptop A





Switch A





Switch B:





Laptop B





PC B





PC C





Server A

58. Company A is establishing a contractual with Company

B. The terms of the agreement are formalized in a document covering the payment terms, limitation of liability, and intellectual property rights.

Which of the following documents will MOST likely contain these elements

59. After a cybersecurity incident, a judge found that a company did not conduct a proper forensic investigation. The company was ordered to pay penalties.

Which of the following forensic steps would be best to prevent this from happening again?

60. A security engineer is working for a service provider and analyzing logs and reports from a new EDR solution, which is installed on a small group of workstations. Later that day, another security engineer receives an email from two developers reporting the software being used for development activities is now blocked. The developers have not made any changes to the software being used.

Which of the following is the EDR reporting?

61. A security administrator needs to recommend an encryption protocol after a legacy stream cipher was deprecated when a security flaw was discovered. The legacy cipher excelled at maintaining strong cryptographic security and provided great performance for a streaming video service.

Which of the following AES modes should the security administrator recommend given these requirements?

62. A security architect examines a section of code and discovers the following:





Which of the following changes should the security architect require before approving the code for release?

63. An administrator at a software development company would like to protect the integrity of the company's applications with digital signatures. The developers report that the signing process keeps failing on all applications. The same key pair used for signing, however, is working properly on the website, is valid, and is issued by a trusted CA.

Which of the following is MOST likely the cause of the signature failing?

64. A company has a website with a huge database. The company wants to ensure that a DR site could be brought online quickly in the event of a failover. and end users would miss no more than 30 minutes of data.

Which of the following should the company do to meet these objectives?

65. A security engineer is implementing DLP.

Which of the following should the security engineer include in the overall DLP strategy?

66. An organization is assessing the security posture of a new SaaS CRM system that handles sensitive PI I and identity information, such as passport numbers. The SaaS CRM system does not meet the organization's current security standards.

The assessment identifies the following:

1) There will be a 520,000 per day revenue loss for each day the system is delayed going into production.

2) The inherent risk is high.

3) The residual risk is low.

4) There will be a staged deployment to the solution rollout to the contact center.

Which of the following risk-handling techniques will BEST meet the organization's requirements?

67. During a recent breach, an attacker was able to get a user's login credentials by cracking a password that was retrieved via a stolen laptop. The attacker accessed the hashed passwords from the hard drive when it was connected to another device.

Which of the following security measures could have helped prevent this account from being compromised?

68. A local university that has a global footprint is undertaking a complete overhaul of its website and associated systems.

Some of the requirements are:

• Handle an increase in customer demand of resources

• Provide quick and easy access to information

• Provide high-quality streaming media

• Create a user-friendly interface

Which of the following actions should be taken FIRST?

69. A security review of the architecture for an application migration was recently completed.

The following observations were made:

• External inbound access is blocked.

• A large amount of storage is available.

• Memory and CPU usage are low.

• The load balancer has only a single server assigned.

• Multiple APIs are integrated.

Which of the following needs to be addressed?

70. During a phishing exercise, a few privileged users ranked high on the failure list. The enterprise would like to ensure that privileged users have an extra security-monitoring control in place.

Which of the following Is the MOST likely solution?

71. Immediately following the report of a potential breach, a security engineer creates a forensic image of the server in question as part of the organization incident response procedure.

Which of the must occur to ensure the integrity of the image?

72. A security engineer needs to recommend a solution that will meet the following requirements:

Identify sensitive data in the provider’s network

Maintain compliance with company and regulatory guidelines

Detect and respond to insider threats, privileged user threats, and compromised accounts Enforce datacentric security, such as encryption, tokenization, and access control

Which of the following solutions should the security engineer recommend to address these requirements?

73. A company hired a third party to develop software as part of its strategy to be quicker to market. The company’s policy outlines the following requirements: https://i.postimg.cc/8P9sB3zx/image.png

The credentials used to publish production software to the container registry should be stored in a secure location.

Access should be restricted to the pipeline service account, without the ability for the third-party developer to read the credentials directly.

Which of the following would be the BEST recommendation for storing and monitoring access to these shared credentials?

74. A vulnerability scanner detected an obsolete version of an open-source file-sharing application on one of a company’s Linux servers. While the software version is no longer supported by the OSS community, the company’s Linux vendor backported fixes, applied them for all current vulnerabilities, and agrees to support the software in the future.

Based on this agreement, this finding is BEST categorized as a:

75. A Chief information Security Officer (CISO) has launched to create a rebuts BCP/DR plan for the entire company. As part of the initiative, the security team must gather data supporting s operational importance for the applications used by the business and determine the order in which the application must be back online.

Which of the following be the FIRST step taken by the team?

76. A company wants to improve the security of its web applications that are running on in-house servers A risk assessment has been performed and the following capabilities are desired:

• Terminate SSL connections at a central location

• Manage both authentication and authorization for incoming and outgoing web service calls

• Advertise the web service API

• Implement DLP and anti-malware features

Which of the following technologies will be the BEST option?

77. A small company needs to reduce its operating costs. vendors have proposed solutions, which all focus on management of the company’s website and services. The Chief information Security Officer (CISO) insist all available resources in the proposal must be dedicated, but managing a private cloud is not an option.

Which of the following is the BEST solution for this company?

78. A security team is concerned with attacks that are taking advantage of return-oriented programming against the company's public-facing applications.

Which of the following should the company implement on the public-facing servers?

79. A financial institution generates a list of newly created accounts and sensitive information on a daily basis. The financial institution then sends out a file containing thousands of lines of data.

Which of the following would be the best way to reduce the risk of a malicious insider making changes to the file that could go undetected?

80. A cyberanalyst has been tasked with recovering PDF files from a provided image file.

Which of the following is the best file-carving tool for PDF recovery?

81. A local government that is investigating a data exfiltration claim was asked to review the fingerprint of the malicious user's actions. An investigator took a forensic image of the VM an downloaded the image to a secured USB drive to share with the government.

Which of the following should be taken into consideration during the process of releasing the drive to the government?

82. A development team needs terminal access to preproduction servers to verify settings and enter purchased license keys.

To address the team’s needs, the security administrator implements the following requirements:

• Only trusted accounts can access the preproduction servers.

• Developers cannot access the preproduction servers directly from their workstations.

• The trusted accounts should only have access to specific preproduction servers.

Which of the following are necessary to fulfill the security requirements? (Select two).

83. A security analyst discovered that the company's WAF was not properly configured.

The main web server was breached, and the following payload was found in one of the malicious requests:





Which of the following would BEST mitigate this vulnerability?

84. A health company has reached the physical and computing capabilities in its datacenter, but the computing demand continues to increase. The infrastructure is fully virtualized and runs custom and commercial healthcare application that process sensitive health and payment information.

Which of the following should the company implement to ensure it can meet the computing demand while complying with healthcare standard for virtualization and cloud computing?

85. A security administrator wants to enable a feature that would prevent a compromised encryption key from being used to decrypt all the VPN traffic.

Which of the following should the security administrator use?

86. A company is moving most of its customer-facing production systems to the cloud-facing production systems to the cloud. IaaS is the service model being used. The Chief Executive Officer is concerned about the type of encryption available and requires the solution must have the highest level of security.

Which of the following encryption methods should the cloud security engineer select during the implementation phase?

87. The Chief information Security Officer (CISO) of a small locate bank has a compliance requirement that a third-party penetration test of the core banking application must be conducted annually.

Which of the following services would fulfill the compliance requirement with the LOWEST resource usage?

88. A security analyst at a global financial firm was reviewing the design of a cloud-based system to identify opportunities to improve the security of the architecture. The system was recently involved in a data breach after a vulnerability was exploited within a virtual machine's operating system. The analyst observed the VPC in which the system was located was not peered with the security VPC that contained the centralized vulnerability scanner due to the cloud provider's limitations.

Which of the following is the BEST course of action to help prevent this situation m the near future?

89. A security analyst is validating the MAC policy on a set of Android devices. The policy was written to ensure non-critical applications are unable to access certain resources.

When reviewing dmesg, the analyst notes many entries such as:

Despite the deny message, this action was still permit following is the MOST likely fix for this issue?

90. An organization is assessing the security posture of a new SaaS CRM system that handles sensitive Pll and identity information, such as passport numbers. The SaaS CRM system does not meet the organization's current security standards.

The assessment identifies the following:

1- There will be a $20,000 per day revenue loss for each day the system is delayed going into production.

2- The inherent risk is high.

3- The residual risk is low.

4- There will be a staged deployment to the solution rollout to the contact center.

Which of the following risk-handling techniques will BEST meet the organization's requirements?

91. A Chief Information Officer is considering migrating all company data to the cloud to save money on expensive SAN storage.

Which of the following is a security concern that will MOST likely need to be addressed during migration?

92. A systems administrator is preparing to run a vulnerability scan on a set of information systems in the organization. The systems administrator wants to ensure that the targeted systems produce accurate information especially regarding configuration settings.

Which of the following scan types will provide the systems administrator with the MOST accurate information?

93. An organization wants to implement an access control system based on its data classification policy that includes the following data types:

Confidential

Restricted

Internal

Public

The access control system should support SSO federation to map users into groups. Each group should only access systems that process and store data at the classification assigned to the group.

Which of the following should the organization implement to enforce its requirements with minimal impact to systems and resources?

94. A security architect is reviewing the following organizational specifications for a new application:

• Be sessionless and API-based

• Accept uploaded documents with Pll, so all storage must be ephemeral

• Be able to scale on-demand across multiple nodes

• Restrict all network access except for the TLS port

Which of the following ways should the architect recommend the application be deployed in order to meet security and organizational infrastructure requirements?

95. A Chief Information Security Officer is concerned about the condition of the code security being used for web applications. It is important to get the review right the first time, and the company is willing to use a tool that will allow developers to validate code as it is written.

Which of the following methods should the company use?

96. A healthcare system recently suffered from a ransomware incident As a result the board of directors decided to hire a security consultant to improve existing network security. The security consultant found that the healthcare network was completely flat, had no privileged access limits and had open RDP access to servers with personal health information.

As the consultant builds the remediation plan, which of the following solutions would BEST solve these challenges? (Select THREE).

97. A security architect is implementing a web application that uses a database back end. Prior to the production, the architect is concerned about the possibility of XSS attacks and wants to identify security controls that could be put in place to prevent these attacks.

Which of the following sources could the architect consult to address this security concern?

98. A security researcher identified the following messages while testing a web application:





Which of the following should the researcher recommend to remediate the issue?

99. A forensic expert working on a fraud investigation for a US-based company collected a few disk images as evidence.

Which of the following offers an authoritative decision about whether the evidence was obtained legally?

100. A security analyst notices a number of SIEM events that show the following activity:





Which of the following response actions should the analyst take FIRST?

101. The OS on several servers crashed around the same time for an unknown reason. The servers were restored to working condition, and all file integrity was verified.

Which of the following should the incident response team perform to understand the crash and prevent it in the future?

102. An organization is in frequent litigation and has a large number of legal holds.

Which of the following types of functionality should the organization's new email system provide?

103. An analyst determined that the current process for manually handling phishing attacks within the company is ineffective. The analyst is developing a new process to ensure phishing attempts are handled internally in an appropriate and timely manner. One of the analyst's requirements is that a blocklist be updated automatically when phishing attempts are identified.

Which of the following would help satisfy this requirement?

104. As part of its risk strategy, a company is considering buying insurance for cybersecurity incidents.

Which of the following BEST describes this kind of risk response?

105. A security administrator has been provided with three separate certificates and is trying to organize them into a single chain of trust to deploy on a website.

Given the following certificate properties:





Which of the following are true about the PKI hierarchy? (Select two).

106. An accounting team member received a voicemail message from someone who sounded like the Chief Financial Officer (CFO). In the voicemail message, the caller requested a wire transfer to a bank account the organization had not used before.

Which of the following best describes this type of attack?

107. A company’s product site recently had failed API calls, resulting in customers being unable to check out and purchase products. This type of failure could lead to the loss of customers and damage to the company’s reputation in the market.

Which of the following should the company implement to address the risk of system unavailability?

108. A SOC analyst received an alert about a potential compromise and is reviewing the following SIEM logs:





Which of the following is the most appropriate action for the SOC analyst to recommend?

109. A Chief Information Security Officer (CISO) is concerned that a company's current data disposal procedures could result in data remanence. The company uses only SSDs.

Which of the following would be the MOST secure way to dispose of the SSDs given the CISO's concern?

110. A new web server must comply with new secure-by-design principles and PCI DSS. This includes mitigating the risk of an on-path attack.

A security analyst is reviewing the following web server configuration:





Which of the following ciphers should the security analyst remove to support the business requirements?

111. A security analyst is reviewing the following output from a vulnerability scan from an organization's internet-facing web services:





Which of the following indicates a susceptibility whereby an attacker can take advantage of the trust relationship between the client and the server?

112. A security engineer is reviewing metrics for a series of bug bounty reports. The engineer finds systematic cross-site scripting issues and unresolved previous findings.

Which of the following is the best solution to address the issue?

113. A security analyst is reviewing a new IOC in which data is injected into an online process.

The IOC shows the data injection could happen in the following ways:

• Five numerical digits followed by a dash, followed by four numerical digits; or

• Five numerical digits

When one of these IOCs is identified, the online process stops working.

Which of the following regular expressions should be implemented in the NIPS?

114. A regulated company is in the process of refreshing its entire infrastructure. The company has a business-critical process running on an old 2008 Windows server.

If this server fails, the company would lose millions of dollars in revenue.

Which of the following actions should the company take?

115. During a recent security incident investigation, a security analyst mistakenly turned off the infected machine prior to consulting with a forensic analyst. upon rebooting the machine, a malicious script that was running as a background process was no longer present. As a result, potentially useful evidence was lost.

Which of the following should the security analyst have followed?

116. An organization's finance system was recently attacked. A forensic analyst is reviewing the contents Of the compromised files for credit card data.

Which of the following commands should the analyst run to BEST determine whether financial data was lost?

117. A security engineer is reviewing Apache web server logs and has identified the following pattern in the log:

GET https://example.com/image5/../../etc/passwd HTTP/1.1 200 OK

The engineer has also reviewed IDS and firewall logs and established a correlation to an external IP

address.

Which of the following can be determined regarding the vulnerability and response?

118. A web service provider has just taken on a very large contract that comes with requirements that are currently not being implemented in order to meet contractual requirements, the company must achieve the following thresholds

• 99 99% uptime

• Load time in 3 seconds

• Response time = <1 0 seconds

Starting with the computing environment, which of the following should a security engineer recommend to BEST meet the requirements? (Select THREE)

119. A system administrator at a medical imaging company discovers protected health information (PHI) on a general-purpose file server.

Which of the following steps should the administrator take NEXT?

120. A company would like to move its payment card data to a cloud provider.

Which of the following solutions will best protect account numbers from unauthorized disclosure?

121. An organization is designing a network architecture that must meet the following requirements:

Users will only be able to access predefined services.

Each user will have a unique allow list defined for access.

The system will construct one-to-one subject/object access paths dynamically.

Which of the following architectural designs should the organization use to meet these requirements?

122. A company Is adopting a new artificial-intelligence-based analytics SaaS solution. This Is the company's first attempt at using a SaaS solution, and a security architect has been asked to determine any future risks.

Which of the following would be the GREATEST risk In adopting this solution?

123. An attacker infiltrated the code base of a hardware manufacturer and inserted malware before the code was compiled. The malicious code is now running at the hardware level across a number of industries and sectors.

Which of the following categories BEST describes this type of vendor risk?

124. An multinational organization was hacked, and the incident response team's timely action prevented a major disaster Following the event, the team created an after action report.

Which of the following is the primary goal of an after action review?

125. The management team at a company with a large, aging server environment is conducting a server risk assessment in order to create a replacement strategy. The replacement strategy will be based upon the likelihood a server will fail, regardless of the criticality of the application running on a particular server.

Which of the following should be used to prioritize the server replacements?

126. A company that uses AD is migrating services from LDAP to secure LDAP. During the pilot phase, services are not connecting properly to secure LDAP.

Block is an except of output from the troubleshooting session:





Which of the following BEST explains why secure LDAP is not working? (Select TWO.)

127. A cloud security architect has been tasked with selecting the appropriate solution given the following:

* The solution must allow the lowest RTO possible.

* The solution must have the least shared responsibility possible.

« Patching should be a responsibility of the CSP.

Which of the following solutions can BEST fulfill the requirements?

128. A company is migrating from company-owned phones to a BYOD strategy for mobile devices. The pilot program will start with the executive management team and be rolled out to the rest of the staff in phases. The company’s Chief Financial Officer loses a phone multiple times a year.

Which of the following will MOST likely secure the data on the lost device?

129. An application security engineer is performing a vulnerability assessment against a new web application that uses SAML. The engineer wants to identify potential authentication issues within the application.

Which of the following methods would be most appropriate for the engineer to perform?

130. The solution must ensure the application is not susceptible to memory leaks.

Which of the following should be implemented to meet these requirements? (Select two).

131. An organization has a secure manufacturing facility that is approximately 10mi (16km) away from its corporate headquarters. The organization's management team is concerned about being able to track personnel who utilize the facility.

Which of the following would best help to prevent staff from being tracked?

132. A company is migrating its data center to the cloud. Some hosts had been previously isolated, but a risk assessment convinced the engineering team to reintegrate the systems. Because the systems were isolated, the risk associated with vulnerabilities was low.

Which of the following should the security team recommend be performed before migrating these servers to the cloud?

133. An organization has an operational requirement with a specific equipment vendor The organization is located in the United States, but the vendor is located in another region.

Which of the following risks would be most concerning to the organization in the event of equipment failure?

134. A PKI engineer is defining certificate templates for an organization's CA and would like to ensure at least two of the possible SAN certificate extension fields populate for documentation purposes.

Which of the following are explicit options within this extension? (Select two).

135. The principal security analyst for a global manufacturer is investigating a security incident related to abnormal behavior in the ICS network.

A controller was restarted as part of the troubleshooting process, and the following issue was identified when the controller was restarted:





During the investigation, this modified firmware version was identified on several other controllers at the site. The official vendor firmware versions do not have this checksum.

Which of the following stages of the MITRE ATT&CK framework for ICS includes this technique?

136. An administrator completed remediation for all the findings of a penetration test and notifies the management team that the systems are ready to be placed back into production.

Which of the following steps should the management team require the analyst to perform immediately before placing the systems back into production?

137. An analyst is working to address a potential compromise of a corporate endpoint and discovers the attacker accessed a user’s credentials. However, it is unclear if the system baseline was modified to achieve persistence.

Which of the following would most likely support forensic activities in this scenario?

138. Which of the following controls primarily detects abuse of privilege but does not prevent it?

139. A security engineer has been asked to close all non-secure connections from the corporate network. The engineer is attempting to understand why the corporate UTM will not allow users to download

email via IMAPS. The engineer formulates a theory and begins testing by creating the firewall ID 58, and users are able to download emails correctly by using IMAP instead.

The network comprises three VLANs:





The security engineer looks at the UTM firewall rules and finds the following:





Which of the following should the security engineer do to ensure IMAPS functions properly on the corporate user network?

140. A company created an external, PHP-based web application for its customers. A security researcher reports that the application has the Heartbleed vulnerability.

Which of the following would BEST resolve and mitigate the issue? (Select TWO).

141. A recent security assessment generated a recommendation to transition Wi-Fi to WPA2/WPA3 Enterprise requiring EAP-TLS.

Which of the following conditions must be met for the organization's mobile devices to be able to successfully join the corporate wireless network?

142. A company recently acquired a SaaS provider and needs to integrate its platform into the company's existing infrastructure without impact to the customer's experience. The SaaS provider does not have a mature security program A recent vulnerability scan of the SaaS provider's systems shows multiple critical vulnerabilities attributed to very old and outdated Oss.

Which of the following solutions would prevent these vulnerabilities from being introduced into the company's existing infrastructure?

143. A security engineer is creating a single CSR for the following web server hostnames:

• wwwint internal

• www company com

• home.internal

• www internal

Which of the following would meet the requirement?

144. In order to authenticate employees who, call in remotely, a company's help desk staff must be able to view partial Information about employees because the full information may be considered sensitive.

Which of the following solutions should be implemented to authenticate employees?

145. A technology company developed an in-house chat application that is used only by developers. An open-source library within the application has been deprecated.

The facts below are provided:

The cost of replacing this system is nominal.

The system provides no revenue to the business.

The system is not a critical part of the business.

Which of the following is the best risk mitigation strategy?

146. A mobile administrator is reviewing the following mobile device DHCP logs to ensure the proper mobile settings are applied to managed devices:





Which of the following mobile configuration settings is the mobile administrator verifying?

147. To bring digital evidence in a court of law the evidence must be:

148. The Chief Information Security Officer of a startup company has asked a security engineer to implement a software security program in an environment that previously had little oversight.

Which of the following testing methods would be BEST for the engineer to utilize in this situation?

149. A company is preparing to deploy a global service.

Which of the following must the company do to ensure GDPR compliance? (Choose two.)

150. An auditor needs to scan documents at rest for sensitive text. These documents contain both text and Images.

Which of the following software functionalities must be enabled in the DLP solution for the auditor to be able to fully read these documents? (Select TWO).

151. hgQ43jsu23Ly.com

Which of the following should the analyst do next?

152. Which of the following should an organization implement to prevent unauthorized API key sharing?

153. An attacker infiltrated an electricity-generation site and disabled the safety instrumented system. Ransomware was also deployed on the engineering workstation. The environment has back-to-back firewalls separating the corporate and OT systems.

Which of the following is the MOST likely security consequence of this attack?

154. A recent audit discovered that multiple employees had been using their badges to walk through the secured data center to get to the employee break room. Most of the employees were given access during a previous project, but the access was not removed in a timely manner when the project was complete.

Which of the following would reduce the likelihood of this scenario occurring again?

155. A company has decided that only administrators are permitted to use PowerShell on their Windows computers.

Which of the following is the BEST way for an administrator to implement this decision?

156. A security architect discovers the following while reviewing code for a company’s website:

selection = "SELECT Item FROM Catalog WHERE ItemID * " & Request("ItemID”)

Which of the following should the security architect recommend?

157. A security administrator configured the account policies per security implementation guidelines.

However, the accounts still appear to be susceptible to brute-force attacks.

The following settings meet the existing compliance guidelines:

Must have a minimum of 15 characters

Must use one number

Must use one capital letter

Must not be one of the last 12 passwords used

Which of the following policies should be added to provide additional security?

158. An organization requires a legacy system to incorporate reference data into a new system. The organization anticipates the legacy system will remain in operation for the next 18 to 24 months. Additionally, the legacy system has multiple critical vulnerabilities with no patches available to resolve them.

Which of the following is the BEST design option to optimize security?

159. After a security incident, a network security engineer discovers that a portion of the company’s sensitive external traffic has been redirected through a secondary ISP that is not normally used.

Which of the following would BEST secure the routes while allowing the network to function in the event of a single provider failure?

160. An application server was recently upgraded to prefer TLS 1.3, and now users are unable to connect their clients to the server.

Attempts to reproduce the error are confirmed, and clients are reporting the following:

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Which of the following is MOST likely the root cause?

161. An IT department is currently working to implement an enterprise DLP solution. Due diligence and best practices must be followed in regard to mitigating risk.

Which of the following ensures that authorized modifications are well planned and executed?

162. A company’s Chief Information Security Officer is concerned that the company’s proposed move to the cloud could lead to a lack of visibility into network traffic flow logs within the VPC.

Which of the following compensating controls would be BEST to implement in this situation?

163. Topic 3, Exam Pool C



A software company is developing an application in which data must be encrypted with a cipher that requires the following:

* Initialization vector

* Low latency

* Suitable for streaming

Which of the following ciphers should the company use?

164. In a shared responsibility model for PaaS, which of the following is a customer's responsibility?

165. An energy company is required to report the average pressure of natural gas used over the past quarter. A PLC sends data to a historian server that creates the required reports.

Which of the following historian server locations will allow the business to get the required reports in an ОТ and IT environment?

166. A company undergoing digital transformation is reviewing the resiliency of a CSP and is concerned about meeting SLA requirements in the event of a CSP incident.

Which of the following would be BEST to proceed with the transformation?