The security team has been notified about multiple man-in-the-middle (MITM) attacks happening on the wireless network over the past thirty days. Management has agreed to upgrade the network infrastructure to help eliminate these attacks.
Which solution fulfills these requirements?
A company is developing a new mobile application to support external customers and contractors. The application needs to allow users to sign in using third-party social identities.
What is the best protocol?
A security analyst for a financial institution is in the process of planning to upgrade the institution’s IT infrastructure to meet current industry standards. There are various potential risks associated with the upgrade, including data breaches, system outages, and cost overruns. The analyst is tasked with managing these risks to ensure a successful upgrade.
What is the first step in the risk management life cycle in this scenario?
A software development company has experienced a noticeable slowdown in its network performance, which suggests that some machines on the network may have been infected by a botnet. The company has decided to analyze the threats and vulnerabilities within the enterprise based on the indicators of compromise to mitigate the risk.
What should the company do to detect a botnet and other malware-based threats within the enterprise based on the indicators of compromise?
A retail company wants to establish the frequency at which it needs to backup its critical data to ensure it can be restored in case of a disruption with the least amount of acceptable loss in recovery.
What is the term used to describe this metric?
A company is developing a new system to process personal information about its customers, including their names, addresses, and purchase histories.
Which term describes the process of identifying and evaluating the potential effects that the new system may have on the privacy of personal information and developing strategies to mitigate those risks?
A healthcare organization would like to interoperate with another healthcare organization without needing to maintain individual accounts for members of the other organization.
Which technology concept should the company use?
A company may choose to use CDs, DVDs, hard drives, or even cloud storage for data backup.
Which aspect of data backup does this statement describe?
An IT organization needs to enable secure communication across virtual networks in Microsoft Azure and Amazon Web Services.
Which protocol will offer the most reliable and secure method for data transport?
The security team manages a set of legacy firewalls that have been in production for nearly tenyears. The organization recently issued a mandate requiring that all firewalls be configured with intrusion detection controls that alert the team in real time based on known threats.
Which encryption technique can be used to enable a third-party provider to perform calculations on encrypted data without decrypting the data?
An employee needs to execute a program from the command line.
Which peripheral device should be used?
A company has recently completed its disaster recovery plan and is preparing to test it. The company’s IT team has identified the need to simulate a disaster scenario to evaluate the effectiveness of the plan. The team has considered a few options, including a full interruption test, a walk-through, tabletop exercises, and checklists. They want to choose a testing method that will allow them to evaluate the plan in a controlled environment while minimizing the impact on the company’s operations.
Which testing method will meet the needs of the company?
An IT organization recently implemented a hybrid cloud deployment. The security team must be able to correlate event data combined from different sources in a central location.
A medium-sized grocery chain with locations all across the United States has a new business requirement that all devices must authenticate to access its resources.
What should the grocery chain use for the devices to authenticate?
An organization wants to securely transmit sensitive information between two parties. The organization wants to use a cryptographic technique that allows both parties to encrypt anddecrypt messages using the same key. The organization is also concerned about the performance impact of the encryption technique.
Which type of cryptographic algorithm meets the needs of the organization?
An organization sends customers e-mail messages based on their purchase patterns.
Which characteristic of quality data does this represent?
A company has discovered a vulnerability in its Domain Name System (DNS) that could allow attackers to redirect users to malicious websites. The company has decided to implement a risk management strategy to mitigate this vulnerability.
What is the most effective risk management strategy for this vulnerability?
A company's website is suddenly redirecting users to a suspicious landing page asking for personal information.
What is the most likely cause of the issue?
What does the following SQL statement produce when executed?
SELECT ‘ FROM Customers
WHERE State = ’Arizona';
Which statement best describes the purpose of a business intelligence (Bl) system?
The cybersecurity analyst at a hardware company conducted a vulnerability assessment to identify potential security risks to the organization and discovered multiple vulnerabilities on the company’s webpage. The analyst then provided the results to the Chief Information Security Officer (CISO), who then decided to decommission the website and create a new page with increased security controls.
A government agency is planning a hybrid cloud deployment. Strict controls must be in placethat can label classified data. The solution must ensure that access rights will be granted based on the user’s government security classification.
An e-learning company uses Amazon Simple Storage Service (Amazon S3) to store e-books and video files that are served to customers through a custom application. The company has realized that someone has been stealing its intellectual property.
Which threat actor is most likely in this scenario?
A software development company is concerned about the potential risks associated with exploits that target vulnerabilities in the Linux operating system used by the company’s servers. Thecompany has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this company?
What type of a system requirement involves preventing unauthorized access to data?
A cloud hosting provider is concerned about the potential risks associated with attacks that target the confidentiality and integrity of sensitive data stored on its servers' volatile storage. The provider has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this provider?
A company has recently failed a security audit. Many of the end users have passwords older than 365 days.
Which password policy type will prevent this issue?
The security team has been tasked with selecting a password complexity policy for the organization.
Which password complexity policy option should be recommended?
A healthcare organization has experienced a ransomware attack that has resulted in the encryption of all patient medical records. The organization has backups, but restoring the data will take severaldays, and during that time, patient care will be significantly diminished.
What is the most important factor to consider when evaluating the severity of the ransomware attack?
A company is moving its applications to the cloud and is concerned about cyber security threats. The security team has been tasked with providing a comprehensive view of how attackers gainaccess, move through networks, and carry out attacks.
Which framework identifies the seven phases of an attack, from initial infiltration to post-exploitation?
A security team is investigating multiple man-in-the-middle attacks that have taken place on the corporate network over the past few months. The team needs a solution that will ensure that data is not exposed if a man-in-the-middle attack occurs in the future.
What is the best solution?
A large technology company has discovered a known vulnerability in its network infrastructure.The infrastructure contains a number of retired assets that are no longer receiving security updates, which could potentially be exploited by attackers to compromise the network. The company has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this company?
A company recently updated its disaster recovery plan (DRP) to ensure business continuity in the event of a disruptive incident.
Which step will ensure the effectiveness of the DRP?
A retail company wants to establish the frequency at which it needs to back up its critical data to ensure it can be restored in case of a disruption with the least amount of acceptable data loss.
What is the term used to describe this metric?
Which risk management strategy will ensure the secure storage of data on a new document management system?
A retail company has recently implemented a new point of sale (POS) system that is critical to its business.
Which security control is essential for protecting the availability of the POS system?
An IT organization recently implemented a hybrid cloud deployment. The security team must be able to correlate event data combined from different sources in a central location.
What is the best solution?
A company is concerned about the potential risks associated with unauthorized modifications to the Basic Input/Output System (BIOS) firmware on its servers. The company has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which technique will prevent unauthorized modifications to the BIOS firmware on a server?
A small online retailer stores customer information, product inventory, and financial data on its local servers.
What are the necessary components of a business continuity and disaster recovery plan for this company?
A company has discovered a vulnerability in its domain name system (DNS) that could allow attackers to redirect users to malicious websites. The company has decided to implement a risk management strategy to mitigate this vulnerability.
What is the most effective risk management strategy for this vulnerability?
A company has recently experienced a data breach from an insider threat and wants to implement a policy to reduce the risk of similar incidents in the future. During the incident, the insider threat accessed sensitive information stored in the administrator account from their user account. The insider threat was not in a supervisory role at the time of the incident.
Which policy should the company implement?
A healthcare organization is concerned about the potential risks associated with unauthorized access to sensitive patient information on its endpoint devices. The organization has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this organization?
The security team manages a set of legacy firewalls that have been in production for nearly ten years. The organization recently issued a mandate requiring that all firewalls be configured with intrusion detection controls that alert the team in real time based on inbound threats.
Which solution meets these requirements?
A company wants to secure its computer systems and prevent any unauthorized access to its network. The company wants to implement a security solution that can restrict network traffic to only approved services and applications.
Which security technology will meet the needs of this company?
Which risk management strategy will ensure the secure storage of data on a new document management system?
A professional services organization deployed security edge devices in key locations on its corporate network.
How will these devices improve the organization's security posture?
An organization is experiencing multiple instances of attempted access from geographicallocations where there are no corporate offices or staff.
What should a network administrator do to prevent further access attempts?
While undergoing a security audit, it is determined that an organization has several backup repositories nested in the cloud without any level of protection. Which action should be taken to protect the backup repositories first?
A cloud hosting provider is concerned about the potential risks associated with attacks that target the confidentiality and integrity of sensitive data stored on its servers’ volatile memory. The provider has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this provider?
Which risk management strategy will help prevent cheating using a learning management system as a platform?
A security engineer has been asked to audit unapproved changes that have recently taken place in a corporate application.
Which logging mechanism will create an audit trail?
An engineer has noticed increased network traffic originating from an unknown internet protocol (IP) address.
Which action should be taken to analyze the unusual network traffic patterns?
TESTED 16 Jun 2025
