Free CompTIA SecurityX CAS-005 Practice Questions

Question 1

An organization is working to secure its development process to ensure developers cannot deploy artifacts directly into the production environment.

Which of the following security practice recommendations would be the best to accomplish this objective?

1. Implement least privilege access to all systems.
2. Roll out security awareness training for all users.
3. Set up policies and systems with separation of duties.
4. Enforce job rotations for all developers and administrators.
5. Utilize mandatory vacations for all developers.
6. Review all access to production systems on a quarterly basis.

Question 2

A security architect discovers the following while reviewing code for a company's website: selection = "SELECT Item FROM Catalog WHERE ItemID = " & Request("ItemID")

Which of the following should the security architect recommend?

1. Client-side processing
2. Query parameterization
3. Data normalization
4. Escape character blocking
5. URL encoding

Question 3

A CRM company leverages a CSP PaaS service to host and publish Its SaaS product. Recently, a large customer requested that all infrastructure components must meet strict regulatory requirements, including configuration management, patch management, and life-cycle management.

Which of the following organizations is responsible for ensuring those regulatory requirements are met?

1. The CRM company
2. The CRM company's customer
3. The CSP
4. The regulatory body

Question 4

Company A is merging with Company B. Company A is a small, local company. Company B has a large, global presence. The two companies have a lot of duplication in their IT systems, processes, and procedures. On the new Chief Information Officer's (CIO's) first day, a fire breaks out at Company B's main data center.

Which of the following actions should the CIO take first?

1. Determine whether the incident response plan has been tested at both companies, and use it to respond.
2. Review the incident response plans, and engage the disaster recovery plan while relying on the IT leaders from both companies.
3. Ensure hot, warm, and mobile disaster recovery sites are available, and give an update to the companies' leadership teams.
4. Initiate Company A's IT systems processes and procedures, assess the damage, and perform a BIA.

Question 5

A security analyst is investigating a possible insider threat incident that involves the use of an unauthorized USB from a shared account to exfiltrate data. The event did not create an alert. The analyst has confirmed the USB hardware ID is not on the device allow list, but has not yet confirmed the owner of the USB device.

Which of the following actions should the analyst take next?

1. Classify the incident as a false positive.
2. Classify the incident as a false negative.
3. Classify the incident as a true positive.
4. Classify the incident as a true negative.

Question 6

Which of the following security features do email signatures provide?

1. Non-repudiation
2. Body encryption
3. Code signing
4. Sender authentication
5. Chain of custody

Question 7

A software development company wants to ensure that users can confirm the software is legitimate when installing it.

Which of the following is the best way for the company to achieve this security objective?

1. Code signing
2. Non-repudiation
3. Key escrow
4. Private keys

Question 8

While performing mandatory monthly patch updates on a production application server, the security analyst reports an instance of buffer overflow for a new application that was migrated to the cloud and is also publicly exposed. Security policy requires that only internal users have access to the application.

Which of the following should the analyst implement to mitigate the issues reported? (Choose two.)

1. Configure firewall rules to block all external traffic.
2. Enable input validation for all fields.
3. Enable automatic updates to be installed on all servers.
4. Configure the security group to enable external traffic.
5. Set up a DLP policy to alert for exfiltration on all application servers.
6. Enable nightly vulnerability scans.

Question 9

PKI can be used to support security requirements in the change management process.

Which of the following capabilities does PKI provide for messages?

1. Non-repudiation
2. Confidentiality
3. Delivery receipts
4. Attestation

Question 10

Several unlabeled documents in a cloud document repository contain cardholder information.

Which of the following configuration changes should be made to the DLP system to correctly label these documents in the future?

1. Digital rights management
2. Network traffic decryption
3. Regular expressions
4. Watermarking

Question 11

A malicious actor exploited firmware vulnerabilities and used rootkits in an attack on an organization. After the organization recovered from the incident, an engineer needs to recommend a solution that reduces the likelihood of the same type of attack in the future.

Which of the following is the most relevant solution?

1. Enabling software integrity checks
2. Installing self-encrypting drives
3. Implementing measured boot
4. Configuring host-based encryption

Question 12

After remote desktop capabilities were deployed in the environment various vulnerabilities were noticed:

• Exfiltration of intellectual property

• Unencrypted files

• Weak user passwords

Which of the following is the best way to mitigate these vulnerabilities? (Choose two.)

1. Implementing data loss prevention
2. Deploying file integrity monitoring
3. Restricting access to critical file services only
4. Deploying directory-based group policies
5. Enabling modem authentication that supports MFA
6. Implementing a version control system
7. Implementing a CMDB platform

Question 13

A systems administrator wants to use existing resources to automate reporting from disparate security appliances that do not currently communicate.

Which of the following is the best way to meet this objective?

1. Configuring an API integration to aggregate the different data sets
2. Combining back-end application storage into a single, relational database
3. Purchasing and deploying commercial off-the-shelf aggregation software
4. Migrating application usage logs to on-premises storage

Question 14

An organization is required to:

• Respond to internal and external inquiries in a timely manner.

• Provide transparency.

• Comply with regulatory requirements.

The organization has not experienced any reportable breaches but wants to be prepared if a breach occurs in the future.

Which of the following is the best way for the organization to prepare?

1. Outsourcing the handling of necessary regulatory filings to an external consultant
2. Integrating automated response mechanisms into the data subject access request process
3. Developing communication templates that have been vetted by internal and external counsel
4. Conducting lessons-learned activities and integrating observations into the crisis management plan

Question 15

A central bank implements strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin.

Which of the following best describes the cyberthreat to the bank?

1. Ability to obtain components during wartime
2. Fragility to DDoS and other availability attacks
3. Physical implants and tampering
4. Non-conformance to accepted manufacturing standards

Question 16

A company wants to invest in research capabilities with the goal to operationalize the research output.

Which of the following is the best option for a security architect to recommend?

1. Dark web monitoring
2. Threat intelligence platform
3. Honeypots
4. Continuous adversary emulation

Question 17

A security engineer must integrate device attestation into user authentication and authorization workflows for mobile devices.

Which of the following best meets the requirements?

1. Enforcing a security boundary for all devices outside the perimeter network
2. Enabling multifactor authentication using biometrics on access attempts
3. Implementing single sign-on to centralize access control enforcement
4. Configuring device profiling for patch level and jailbreak status

Question 18

Which of the following is the main reason quantum computing advancements are leading companies and countries to deploy new encryption algorithms?

1. Encryption systems based on large prime numbers will be vulnerable to exploitation.
2. Zero Trust security architectures will require homomorphic encryption.
3. Perfect forward secrecy will prevent deployment of advanced firewall monitoring techniques.
4. Quantum computers will enable malicious actors to capture IP traffic in real time.

Question 19

A systems administrator at a web-hosting provider has been tasked with renewing the public certificates of all customer sites.

Which of the following would best support multiple domain names while minimizing the amount of certificates needed?

1. OCSP
2. CRL
3. SAN
4. CA

Question 20

A company hosts a platform-as-a-service solution with a web-based front end, through which customers interact with data sets. A security administrator needs to deploy controls to prevent application-focused attacks.

Which of the following most directly supports the administrator’s objective?

1. Improving security dashboard visualization on SIEM
2. Rotating API access and authorization keys every two months
3. Implementing application load balancing and cross-region availability
4. Creating WAF policies for relevant programming languages

Question 21

A systems administrator is working with the SOC to identify potential intrusions associated with ransomware. The SOC wants the systems administrator to perform network-level analysis to identify outbound traffic from any infected machines.

Which of the following is the most appropriate action for the systems administrator to take?

1. Monitor for IoCs associated with C&C communications.
2. Tune alerts to Identify changes to administrative groups.
3. Review NetFlow logs for unexpected increases in egress traffic.
4. Perform binary hash comparisons to identify infected devices.

Question 22

A company notices that cloud environment costs increased after using a new serverless solution based on API requests. Many invalid requests from unknown IPs were found, often within a short time.

Which of the following solutions would most likely solve this issue, reduce cost, and improve security?

1. Using digital certificates for known customers and performing API authorization through those certificates
2. Defining request rate limits and comparing new requests from unknown IPs with a list of known-malicious IPs
3. Setting authentication processes for the API requests as well as proper rate limits according to regular usage
4. Only allowing API requests coming from regions with known customers

Question 23

Which of the following utilizes policies that route packets to ensure only specific types of traffic are being sent to the correct destination based on application usage?

1. SDN
2. pcap
3. vmstat
4. DNSSEC
5. VPC

Question 24

A company migrated a critical workload from its data center to the cloud. The workload uses a very large data set that requires computational-intensive data processing. The business unit that uses the workload is projecting the following growth pattern:

• Storage requirements will double every six months.

• Computational requirements will fluctuate throughout the year

• Average computational requirements will double every year.

Which of the following should the company do to address the business unit's requirements?

1. Deploy a cloud-based CDN for storage and a load balancer for compute
2. Combine compute and storage in vertically autoscaling mode
3. Implement a load balancer for computing and storage resources
4. Plan for a horizontally scaling computing and storage infrastructure

Question 25

A software vendor provides routine functionality and security updates to its global customer base. The vendor would like to ensure distributed updates are authorized, originate from only the company, and have not been modified by others.

Which of the following solutions best supports these objectives?

1. Envelope encryption
2. File integrity monitoring
3. Application control
4. Code signing

Question 26

A company recently experienced an incident in which an advanced threat actor was able to shim malicious code against the hardware stack of a domain controller. The forensic team cryptographically validated that both the underlying firmware of the box and the operating system had not been compromised. However, the attacker was able to exfiltrate information from the server using a steganographic technique within LDAP.

Which of the following is the best way to reduce the risk of reoccurrence?

1. Enforcing allow lists for authorized network ports and protocols
2. Measuring and attesting to the entire boot chain
3. Rolling the cryptographic keys used for hardware security modules
4. Using code signing to verify the source of OS updates

Question 27

After an organization met with its ISAC, the organization decided to test the resiliency of its security controls against a small number of advanced threat actors.

Which of the following will enable the security administrator to accomplish this task?

1. Adversary emulation
2. Reliability factors
3. Deployment of a honeypot
4. Internal reconnaissance

Question 28

A web application server that provides services to hybrid modern and legacy financial applications recently underwent a scheduled upgrade to update common libraries, including OpenSSL. Multiple users are now reporting failed connection attempts to the server. The technician performing initial triage identified the following:

• Client applications more than five years old appear to be the most affected

• Web server logs show initial connection attempts by affected hosts.

• For the failed connections, logs indicate "cipher unavailable. "

Which of the following is most likely to safely remediate this situation?

1. The server needs to be configured for backward compatibility to SSL 3.0 applications.
2. The client applications need to be modified to support AES in Galois/Counter Mode or equivalent
3. The client TLS configuration must be set to enforce electronic codebook modes of operation
4. The server-side digital signature algorithm needs to be modified to support elliptic curve cryptography

Question 29

An organization is looking for gaps in its detection capabilities based on the APTs that may target the industry.

Which of the following should the security analyst use to perform threat modeling?

1. ATT&CK
2. OWASP
3. CAPEC
4. STRIDE

Question 30

A systems administrator needs to identify new attacks that could be carried out against the environment. The administrator plans to proactively seek out and observe new attacks.

Which of the following is the best way to accomplish this goal?

1. Configuring an IPS
2. Implementing sandboxing
3. Scanning for IoCs
4. Deploying a honeypot

Question 31

Which of the following describes how a risk assessment is performed when an organization has a critical vendor that provides multiple products?

1. At the individual product level
2. Through the selection of a random product
3. Using a third-party audit report
4. By choosing a major product

Question 32

A hospital provides tablets to its medical staff to enable them to more quickly access and edit patients' charts. The hospital wants to ensure that if a tablet is identified as lost or stolen and a remote command is issued, the risk of data loss can be mitigated within seconds. The tablets are configured as follows to meet hospital policy:

• Full disk encryption is enabled.

• "Always On" corporate VPN is enabled.

• eFuse-backed keystore is enabled/ready.

• Wi-Fi 6 is configured with SAE.

• Location services is disabled.

• Application allow list is unconfigured.

Assuming the hospital policy cannot be changed, which of the following is the best way to meet the hospital's objective?

1. Revoke the user VPN and Wi-Fi certificates
2. Cryptographically erase FDE volumes
3. Issue new MFA credentials to all users
4. Configure the application allow list

Question 33

A systems engineer is configuring SSO for a business that will be using SaaS applications for its remote-only workforce. Privileged actions in SaaS applications must be allowed only from corporate mobile devices that meet minimum security requirements, but BYOD must also be permitted for other activity.

Which of the following would best meet this objective?

1. Block any connections from outside the business's network security boundary.
2. Install machine certificates on corporate devices and perform checks against the clients.
3. Configure device attestations and continuous authorization controls.
4. Deploy application protection policies using a corporate, cloud-based MDM solution.

Question 34

A company is concerned about the security of customer data. The IT department has configured all web applications with appropriate access controls to restrict to only authorized users.

Which of the following solutions addresses this concern?

1. SIEM
2. Vulnerability scanner
3. DLP
4. Threat intelligence platform

Question 35

An organization decides to move to a distributed workforce model. Several legacy systems exist on premises and cannot be migrated because of existing compliance requirements. However, all new systems are required to be cloud-based.

Which of the following would best ensure network access security?

1. Utilizing a VPN for all users who require legacy system access
2. Shifting all legacy systems to the existing public cloud infrastructure
3. Configuring an SDN to block malicious traffic to on-premises networks
4. Deploying microsegmentation with a firewall acting as the core router

Question 36

A regulated company is in the process of refreshing its entire infrastructure. The company has a business-critical process running on an old 2008 Windows server. If this server fails, the company would lose millions of dollars in revenue.

Which of the following actions should the company should take?

1. Accept the risk as the cost of doing business.
2. Create an organizational risk register for project prioritization.
3. Implement network compensating controls.
4. Purchase insurance to offset the cost if a failure occurred.

Question 37

A company acquires a location with a large infrastructure of legacy devices. Because of the hardware's age and the legacy software's limitations, the OS cannot be upgraded, and the machines cannot be virtualized. These machines are not publicly facing, but they do have internet access. The following controls are currently in place:

• EDR

• Anti-malware

• Logging and monitoring

• Host-based firewall

• Proxied internet access

A security architect needs to supplement the existing control strategy with one that restricts unauthorized software.

Which of the following controls should the architect recommend to best supplement the existing environment?

1. SIEM
2. Isolation
3. Conditional access
4. Application control

Question 38

A security engineer performed a code scan that resulted in many false positives. The security engineer must find a solution that improves the quality of scanning results before application deployment.

Which of the following is the best solution?

1. Limiting the tool to a specific coding language and tuning the rule set
2. Configuring branch protection rules and dependency checks
3. Using an application vulnerability scanner to identify coding flaws in production
4. Performing updates on code libraries before code development

Question 39

A security architect wants to develop a baseline of security configurations. These configurations automatically will be utilized every time a new virtual machine is created.

Which of the following technologies should the security architect deploy to accomplish this goal?

1. Snort
2. CASB
3. Ansible
4. CMDB

Question 40

A security officer received several complaints from users about excessive MFA push notifications at night. The security team investigates and suspects malicious activities regarding user account authentication.

Which of the following is the best way for the security officer to restrict MFA notifications?

1. Provisioning FIDO2 devices
2. Deploying a text message based on MFA
3. Enabling OTP via email
4. Configuring prompt-driven MFA

Question 41

A web service provider has just taken on a very large contract that comes with requirements that are currently not being implemented. In order to meet contractual requirements, the company must achieve the following thresholds:

• 99.99% uptime Load time in 3 seconds

• Response time = <1.0 seconds

Starting with the computing environment, which of the following should a security engineer recommend to best meet the requirements? (Choose three.)

1. Installing a firewall at corporate headquarters
2. Deploying a content delivery network
3. Implementing server clusters
4. Employing bare-metal loading of applications
5. Lowering storage input/output
6. Implementing RAID on the backup servers
7. Utilizing redundant power for all developer workstations

Question 42

Which of the following is the best reason for obtaining file hashes from a confiscated laptop?

1. To prevent metadata tampering on each file
2. To later validate the integrity of each file
3. To generate unique identifiers for each file
4. To preserve the chain of custody of files

Question 43

A company experienced a data breach, resulting in the disclosure of extremely sensitive data regarding a merger. As a regulated entity, the company must comply with reporting and disclosure requirements. The company is concerned about its public image and shareholder values.

Which of the following best supports the organization in addressing its concerns?

1. Data subject access request
2. Business impact analysis
3. Supply chain management program
4. Crisis management plan

Question 44

During DAST scanning, applications are consistently reporting code defects in open-source libraries that were used to build web applications.

Most of the code defects are from using libraries with known vulnerabilities. The code defects are causing product deployment delays.

Which of the following is the best way to uncover these issues earlier in the life cycle?

1. Directing application logs to the SIEM for continuous monitoring
2. Modifying the WAF polices to block against known vulnerabilities
3. Completing an IAST scan against the web application
4. Using a software dependency management solution

Question 45

A company is decommissioning old servers and hard drives that contain sensitive data.

Which of the following best protects against data leakage?

1. Purging
2. Clearing
3. Shredding
4. Degaussing

Question 46

An organization has several systems deployed in a public cloud and wants to confirm that when data retention periods are reached, the data is properly disposed of.

Which of the following best meets the organization's needs?

1. Double encrypting the data using both asymmetric and symmetric keys managed by the cloud service provider
2. Utilizing a data-wiping software to overwrite the existing data
3. Encrypting the data with customer-managed keys and then deleting both the encryption key and the volume
4. Asking the cloud provider for copies of certificates of destruction

Question 47

A security architect for a global organization with a distributed workforce recently received funding to deploy a CASB solution.

Which of the following most likely explains the choice to use a proxy-based CASB?

1. The capability to block unapproved applications and services is possible.
2. Privacy compliance obligations are bypassed when using a user-based deployment.
3. Protecting and regularly rotating API secret keys requires a significant time commitment.
4. Corporate devices cannot receive certificates when not connected to on-premises devices.

Question 48

A security analyst received a notification from a cloud service provider regarding an attack detected on a web server. The cloud service provider shared the following information about the attack:

• The attack came from inside the network.

• The attacking source IP was from the internal vulnerability scanners

• The scanner is not configured to target the cloud servers.

Which of the following actions should the security analyst take first?

1. Create an allow list for the vulnerability scanner IPs in order to avoid false positives
2. Configure the scan policy to avoid targeting an out-of-scope host
3. Set network behavior analysis rules.
4. Quarantine the scanner sensor to perform a forensic analysis

Question 49

A security analyst detected unusual network traffic related to program updating processes. The analyst collected artifacts from compromised user workstations. The discovered artifacts were binary files with the same name as existing valid binaries but with different hashes.

Which of the following solutions would most likely prevent this situation from reoccurring?

1. Improving patching processes
2. Implementing digital signature
3. Performing manual updates via USB ports
4. Allowing only files from internal sources

Question 50

An organization's board of directors has asked the Chief Information Security Officer to build a third-party management program.

Which of the following best explains a reason for this request?

1. Risk transference
2. Supply chain visibility
3. Support availability
4. Vulnerability management

Question 51

Audit findings indicate several user endpoints are not utilizing full disk encryption. During the remediation process, a compliance analyst reviews the testing details for the endpoints and notes the endpoint device configuration does not support full disk encryption.

Which of the following is the most likely reason the device must be replaced?

1. The HSM is outdated and no longer supported by the manufacturer
2. The vTPM was not properly initialized and is corrupt.
3. The HSM is vulnerable to common exploits and a firmware upgrade is needed
4. The motherboard was not configured with a TPM from the OEM supplier
5. The HSM does not support sealing storage

Question 52

A security engineer would like to control configurations on mobile devices while fulfilling the following requirements:

Support and control Apple and Android devices.

The device must be corporate-owned.

Which of the following would enable the engineer to meet these requirements? (Choose two.)

1. Create a group policy to lock down mobile devices.
2. Update verbiage in the acceptable use policy for the internet.
3. Implement an MDM solution.
4. Implement a captive portal solution.
5. Update policy to prohibit the use of BYOD devices.
6. Implement a RADIUS solution.

Question 53

An organization plans to deploy new software. The project manager compiles a list of roles that will be involved in different phases of the deployment life cycle.

Which of the following should the project manager use to track these roles?

1. CMDB
2. Recall tree
3. ITIL
4. RACI matrix

Question 54

Which of the following best explains why AI output could be inaccurate?

1. Model poisoning
2. Social engineering
3. Output handling
4. Prompt injections

Question 55

During an audit at an organization, auditors find that developers are able to promote code to production. The auditors request a full review of all production changes.

Which of the following should the organization implement to prevent a full review in the future?

1. Branch protection
2. Centralized code repositories
3. Interactive application security testing
4. Change control board

Question 56

A security analyst discovers a new device on the company's dedicated IoT subnet during the most recent vulnerability scan. The scan results show numerous open ports and insecure protocols in addition to default usernames and passwords. A camera needs to transmit video to the security server in the IoT subnet.

Which of the following should the security analyst recommend to securely operate the camera?

1. Harden the camera configuration.
2. Send camera logs to the SIEM.
3. Encrypt the camera's video stream.
4. Place the camera on an isolated segment.

Question 57

The principal security analyst for a global manufacturer is investigating a security incident related to abnormal behavior in the ICS network. A controller was restarted as part of the troubleshooting process, and the following issue was identified when the controller was restarted:

SECURE BOOT FAILED:

FIRMWARE MISMATCH EXPECTED UXFDC479 ACTUAL 0x79F31B

During the investigation, this modified firmware version was identified on several other controllers at the site. The official vendor firmware versions do not have this checksum.

Which of the following stages of the MITRE ATT&CK framework for ICS includes this technique?

1. Evasion
2. Persistence
3. Collection
4. Lateral movement

Question 58

A global company with a remote workforce implemented a new VPN solution. After deploying the VPN solution to several hundred users, the help desk starts receiving reports of slow access to both internally and externally available applications. A security analyst reviews the following:

VPN client routing:

0.0.0.0/0 eth1

Which of the following solutions should the analyst use to fix this issue?

1. Move the servers to a screened subnet.
2. Enable split tunneling.
3. Configure an NAC solution.
4. Implement DNS over HTTPS.

Question 59

Which of the following best explains the business requirement a healthcare provider fulfills by encrypting patient data at rest?

1. Securing data transfer between hospitals
2. Providing for non-repudiation of data
3. Reducing liability from identity theft
4. Protecting privacy while supporting portability

Question 60

A security analyst received the following finding from a cloud security assessment tool:

Virtual Machine Data Disk is encrypted with the default encryption key.

Because the organization hosts highly sensitive data files, regulations dictate it must be encrypted so It is unreadable to the CSP.

Which of the following should be implemented to remediate the finding and meet the regulatory requirement? (Choose two.)

1. Disk encryption with customer-provided keys
2. Disk encryption with keys from a third party
3. Row-level encryption with a key escrow
4. File-level encryption with cloud vendor-provided keys
5. File-level encryption with customer-provided keys
6. Disk-level encryption with a cross-signed certificate

Question 61

A security analyst discovered requests associated with IP addresses known for both legitimate and bot-related traffic.

Which of the following should the analyst use to determine whether the requests are malicious?

1. User-agent string
2. Byte length of the request
3. Web application headers
4. HTML encoding field

Question 62

A company is developing an application that will be used to perform e-commerce transactions for a subscription-based service. The application must be able to use previously saved payment methods to perform recurring transactions.

Which of the following is the most appropriate?

1. Tokenization through an HSM
2. Self-encrypting disks with field-level encryption
3. NX/XN Implementation to minimize data retention
4. Token-based access for application users
5. Address space layout randomization

Question 63

A cloud engineer needs to identify appropriate solutions to:

• Provide secure access to internal and external cloud resources.

• Eliminate split-tunnel traffic flows.

• Enable identity and access management capabilities.

Which of the following solutions is the most appropriate?

1. Microsegmentation
2. PAM
3. SD-WAN
4. SASE

Question 64

Which of the following best explain why organizations prefer to utilize code that is digitally signed? (Choose two.)

1. It provides origin assurance.
2. It verifies integrity.
3. It provides increased confidentiality.
4. It integrates with DRMs.
5. It verifies the recipient's identity.
6. It ensures the code is free of malware.

Question 65

A financial technology firm works collaboratively with business partners in the industry to share threat intelligence within a central platform. This collaboration gives partner organizations the ability to obtain and share data associated with emerging threats from a variety of adversaries.

Which of the following should the organization most likely leverage to facilitate this activity?

(Choose two.)

1. CWPP
2. YARA
3. ATT&CK
4. STIX
5. TAXII
6. JTAG

Question 66

A hotel chain wants to use point-of-sale systems to allow customers to check in and out of their rooms without employee assistance. These systems should limit access to a specific set of programs approved to run, with all other programs blocked.

Which of the following should the company configure to best support this goal?

1. Application control using a fresh image, with the applications fully configured as a baseline to build and block other applications from execution
2. A host-based intrusion detection system to monitor and block all suspicious activities if they occur on the systems
3. Anti-malware on these systems and only approved application file locations can be bypassed
4. Event logs to be collected from the systems for all security events and some custom application logs

Question 67

A company wants to implement a three-tier approach to separate the web, database, and application servers. A security administrator must harden the environment.

Which of the following is the best solution?

1. Deploying a VPN to prevent remote locations from accessing server VLANs
2. Configuring a SASE solution to restrict users to server communication
3. Implementing microsegmentation on the server VLANs
4. Installing a firewall and making it the network core

Question 68

A software engineer is creating a CI/CD pipeline to support the development of a web application. The DevSecOps team is required to identify syntax errors.

Which of the following is the most relevant to the DevSecOps team's task?

1. Static application security testing
2. Software composition analysis
3. Runtime application self-protection
4. Web application vulnerability scanning

Question 69

A company recently acquired a SaaS company and performed a gap analysis. The results of the gap analysis Indicate security controls are absent throughout the SDLC and have led to several vulnerable production releases.

Which of the following security tools best reduces the risk of vulnerable code being pushed to production in the future?

1. Static application security testing
2. Regression testing
3. Code signing
4. Sandboxing

Question 70

A security analyst identified a vulnerable and deprecated runtime engine that Is supporting a public-facing banking application. The developers anticipate the transition to modern development environments will take at least a month.

Which of the following controls would best mitigate the risk without interrupting the service during the transition?

1. Shutting down the systems until the code is ready
2. Uninstalling the impacted runtime engine
3. Selectively blocking traffic on the affected port
4. Configuring IPS and WAF with signatures

Question 71

A company wants to perform threat modeling on an internally developed, business-critical application. The Chief Information Security Officer (CISO) is most concerned that the application should maintain 99.999% availability and authorized users should only be able to gain access to data they are explicitly authorized to view.

Which of the following threat-modeling frameworks directly addresses the CISO’s concerns about this system?

1. CAPEC
2. STRIDE
3. ATT&CK
4. TAXII

Question 72

An ISAC supplied recent threat intelligence information about pictures used on social media that provide reconnaissance of systems in use in secure facilities. In response, the Chief Information Security Officer (CISO) wants several configuration changes implemented via the MDM to ensure the following:

• Camera functions and location services are blocked for corporate mobile devices.

• All social media is blocked on the corporate and guest wireless networks.

Which of the following is the CISO practicing to safeguard against the threat?

1. Adversary emulation
2. Operational security
3. Open-source intelligence
4. Social engineering

Question 73

Recently, two large engineering companies in the same line of business decided to approach cyberthreats in a united way.

Which of the following best describes this unified approach?

1. NDA
2. SOW
3. SLA
4. MOU

Question 74

A security engineer receives reports through the organization's bug bounty program about remote code execution in a specific component in a custom application. Management wants to properly secure the component and proactively avoid similar issues.

Which of the following is the best approach to uncover additional vulnerable paths in the application?

1. Leverage an exploitation framework to uncover vulnerabilities.
2. Use fuzz testing to uncover potential vulnerabilities in the application.
3. Utilize a software composition analysis tool to report known vulnerabilities.
4. Reverse engineer the application to look for vulnerable code paths.
5. Analyze the use of an HTTP intercepting proxy to dynamically uncover issues.

Question 75

A security analyst detects a possible RAT infection on a computer in the internal network. After reviewing the details of the alert, the analyst identifies the initial vector of the attack was an email that was forwarded to multiple recipients in the same organizational unit.

Which of the following should the analyst do first to minimize this type of threat in the future?

1. Move from an anti-malware software to an EDR solution.
2. Perform a penetration test to detect technology gaps on the anti-spam solution.
3. Configure an IPS solution in the internal network to mitigate infections.
4. Implement a security awareness program in the organization.

Question 76

A security administrator is setting up a virtualization solution that needs to run services from a single host. Each service should be the only one running in its environment. Each environment needs to have its own operating system as a base but share the kernel version and properties of the running host.

Which of the following technologies would best meet these requirements?

1. Containers
2. Type 1 hypervisor
3. Type 2 hypervisor
4. Virtual desktop infrastructure
5. Emulation

Question 77

A company implemented a NIDS and a NIPS on the most critical environments. Since this implementation the company has been experiencing network connectivity issues.

Which of the following should the security architect recommend for a new NIDS/NIPS implementation?

1. Implementing the NIDS with a port mirror in the core switch and the NIPS in the main firewall
2. Implementing the NIDS and the NIPS together with the main firewall
3. Implementing a NIDS without a NIPS to increase the detection capability
4. Implementing the NIDS in the bastion host and the NIPS in the branch network router

Question 78

An analyst is working to address a potential compromise of a corporate endpoint and discovers the attacker accessed a user's credentials.

However, it is unclear if the system baseline was modified to achieve persistence.

Which of the following would most likely support forensic activities in this scenario?

1. Side-channel analysis
2. Bit-level disk duplication
3. Software composition analysis
4. SCAP scanner

Question 79

A security analyst was monitoring the networks of a group of companies. The analyst identified several periods of concentrated, coordinated activity by unknown actors. The activity repeated at regular intervals and affected all the companies. Minor hardware outages that correlated with the same times as the discovered activity escalated in severity.

Which of the following threat actors was most likely involved?

1. An organized crime collective running a ransomware campaign
2. A group of politically motivated hackers
3. Disgruntled employees who were recently terminated
4. An advanced persistent threat financed by a nation-state

Question 80

A subcontractor develops safety critical avionics software for a major aircraft manufacturer. After an incident, a third-party investigator recommends the company begin to employ formal methods in the development life cycle.

Which of the following findings from the investigation most directly supports the investigator's recommendation?

1. The system’s bill of materials failed to include commercial and open-source libraries.
2. The company lacks dynamic and interactive application security testing standards.
3. The codebase lacks traceability to functional and non-functional requirements.
4. The implemented software inefficiently manages compute and memory resources.

Question 81

A news organization wants to implement workflows that allow users to request that untruthful data be retraced and scrubbed from online publications to comply with the right to be forgotten.

Which of the following regulations is the organization most likely trying to address?

1. GDPR
2. COPPA
3. CCPA
4. DORA

Question 82

Which of the following best explains the importance of determining organizational risk appetite when operating with a constrained budget?

1. Risk appetite directly impacts acceptance of high-impact, low-likelihood events.
2. Organizational risk appetite varies from organization to organization.
3. Budgetary pressure drives risk mitigation planning in all companies.
4. Risk appetite directly influences which breaches are disclosed publicly.

Question 83

A pharmaceutical company uses a cloud provider to host thousands of independent resources in object storage. The company needs a practical and effective means of discovering data, monitoring changes, and identifying suspicious activity.

Which of the following would best meet these requirements?

1. A machine-learning-based data security service
2. A file integrity monitoring service
3. A cloud configuration assessment and compliance service
4. An automated data classification system

Question 84

A company designs policies and procedures for hardening containers deployed in the production environment. However, a security assessment reveals that deployed containers are not complying with the security baseline.

Which of the following solutions best addresses this issue throughout early life-cycle stages?

1. Installing endpoint agents on each container and setting them to report when configurations drift from the baseline
2. Finding hardened container images and enforcing them as the baseline for new deployments
3. Creating a pipeline to check the containers through security gates and validating the baseline controls before the final deployment
4. Running security assessments regularly and checking for the security baseline on containers already in production

Question 85

A security engineer is performing a vulnerability management scan on multihomed Linux systems. The engineer notices that the vulnerability count is high due to the fact that each vulnerability is multiplied by the number of NICs on each system.

Which of the following should the engineer do to deduplicate the vulnerabilities and to associate the vulnerabilities with a particular host?

1. Use a SCAP scanner.
2. Deploy an agent.
3. Initiate a discovery scan.
4. Perform an Nmap scan.

Question 86

A senior cybersecurity engineer is solving a digital certificate issue in which the CA denied certificate issuance due to failed subject identity validation. At which of the following steps within the PKI enrollment process would the denial have occurred?

1. RA
2. OCSP
3. CA
4. IdP

Question 87

A help desk technician is troubleshooting an issue with an employee's laptop that will not boot into its operating system. The employee reported the laptop had been stolen but then found it one day later. The employee has asked the technician for help recovering important data. The technician has identified the following:

The laptop operating system was not configured with BitLocker.

The hard drive has no hardware failures.

Data is present and readable on the hard drive, although it appears to be illegible.

Which of the following is the most likely reason the technician is unable to retrieve legible data from the hard drive?

1. The employee's password was changed, and the new password needs to be used.
2. The PKI certificate was revoked, and a new one must be installed.
3. The hard drive experienced crypto-shredding.
4. The technician is using the incorrect cipher to read the data.

Question 88

A nation-state actor is exposed for attacking large corporations by establishing persistence in smaller companies that are likely to be acquired by these large corporations. The actor then provisions user accounts in the companies for use post-acquisition. Before an upcoming acquisition, a security officer conducts threat modeling with this attack vector.

Which of the following practices is the best way to investigate this threat?

1. Restricting internet traffic originating from countries in which the nation-state actor is known to operate
2. Comparing all existing credentials to personnel and services
3. Auditing vendors to mitigate supply chain risk during the acquisition
4. Placing a hold on all information about corporate interest in acquisitions

Question 89

A security officer performs due diligence activities before implementing a third-party solution into the enterprise environment. The security officer needs evidence from the third party that a data subject access request handling process is in place.

Which of the following is the security officer most likely seeking to maintain compliance?

1. Information security standards
2. E-discovery requirements
3. Privacy regulations
4. Certification requirements
5. Reporting frameworks

Question 90

An organization needs to classify its systems and data in accordance with external requirements.

Which of the following roles is best qualified to perform this task?

1. Systems administrator
2. Data owner
3. Data processor
4. Data custodian
5. Data steward

Question 91

A security engineer reviews an after-action report from a previous security breach and notes a long lag time between detection and containment of a compromised account. The engineer suggests using SOAR to address this concern.

Which of the following best explains the engineer's goal?

1. To prevent accounts from being compromised
2. To enable log correlation using machine learning
3. To orchestrate additional reporting for the security operations center
4. To prepare runbooks to automate future incident response

Question 92

An analyst wants to conduct a risk assessment on a new application that is being deployed. Given the following information:

• Total budget allocation for the new application is unavailable.

• Recovery time objectives have not been set

• Downtime loss calculations cannot be provided

Which of the following statements describes the reason a qualitative assessment is the best option?

1. The analyst has previous work experience in application development
2. Sufficient metrics are not available to conduct other risk assessment types
3. An organizational risk register tracks all risks and mitigations across business units
4. The organization wants to find the monetary value of any outages

Question 93

Two companies that recently merged would like to unify application access between the companies, without initially merging internal authentication stores.

Which of the following technical strategies would best meet this objective?

1. Federation
2. RADIUS
3. TACACS+
4. MFA
5. ABAC

Question 94

A security analyst is assessing a new application written in Java. The security analyst must determine which vulnerabilities exist during runtime.

Which of the following would provide the most exhaustive list of vulnerabilities while meeting the objective?

1. Input validation
2. Dynamic analysis
3. Side-channel analysis
4. Fuzz testing
5. Static analysis

Question 95

While reviewing recent incident reports a security officer discovers that several employees were contacted by the same individual who impersonated a recruiter.

Which of the following best describes this type of correlation?

1. Spear-phishing campaign
2. Threat modeling
3. Red-team assessment
4. Attack pattern analysis

Question 96

A systems administrator wants to reduce the number of failed patch deployments in an organization. The administrator discovers that system owners modify systems or applications in an ad hoc manner.

Which of the following is the best way to reduce the number of failed patch deployments?

1. Compliance tracking
2. Situational awareness
3. Change management
4. Quality assurance

Question 97

A developer receives feedback about code quality and efficiency. The developer needs to identify and resolve the following coding issues before submitting the code changes for peer review:

• Indexing beyond arrays

• Dereferencing null pointers

• Potentially dangerous data type combos

• Unreachable code

• Non-portable constructs

Which of the following would be most appropriate for the developer to use in this situation?

1. Linting
2. SBoM
3. DAST
4. Branch protection
5. Software composition analysis

Question 98

An audit finding reveals that a legacy platform has not retained logs for more than 30 days. The platform has been segmented due to its interoperability with newer technology. As a temporary solution, the IT department changed the log retention to 120 days.

Which of the following should the security engineer do to ensure the logs are being properly retained?

1. Configure a scheduled task nightly to save the logs.
2. Configure event-based triggers to export the logs at a threshold.
3. Configure the SIEM to aggregate the logs.
4. Configure a Python script to move the logs into a SQL database.

Question 99

An internal user can send encrypted emails successfully to all recipients, except one. at an external organization.

When the internal user attempts to send encrypted emails to this external recipient, a security error message appears. The issue does not affect unencrypted emails. The external recipient can send encrypted emails to internal users.

Which of the following is the most likely cause of the issue?

1. The validity dates of the external recipient’s private key do not match the SSH keys with which the internal user is accessing the system.
2. The external recipient has an expired public/private key pair that has not been revoked by the CA.
3. The internal user's company email servers have an incorrect implementation of OCSP and CRL settings.
4. The external recipient's email address and the email address associated with the external recipient's public key are mismatched.

Question 100

During a gap assessment, an organization notes that BYOD usage is a significant risk. The organization implemented administrative policies prohibiting BYOD usage. However, the organization has not implemented technical controls to prevent the unauthorized use of BYOD assets when accessing the organization's resources.

Which of the following solutions should the organization implement to best reduce the risk of BYOD devices? (Choose two.)

1. Cloud IAM, to enforce the use of token-based MFA
2. Conditional access, to enforce user-to-device binding
3. NAC, to enforce device configuration requirements
4. PAM, to enforce local password policies
5. SD-WAN, to enforce web content filtering through external proxies
6. DLP, to enforce data protection capabilities

Question 101

A security technician is trying to connect a remote site to the central office over a site-to-site VPN. The technician has verified the source and destination IP addresses are correct, but the technician is unable to get the remote site to connect. The following error message keeps repeating:

An error has occurred during Phase 1 handshake. Deleting keys and retrying...

Which of the following is most likely the reason the connection is failing?

1. The IKE hashing algorithm uses different key lengths on each VPN device.
2. The IPSec settings allow more than one cipher suite on both devices.
3. The Diffie-Hellman group on both sides matches but is a legacy group.
4. The remote VPN is attempting to connect with a protocol other than SSL/TLS.

Question 102

An incident response team completed recovery from offline backup for several workstations. The workstations were subjected to a ransomware attack after users fell victim to a spear-phishing campaign, despite a robust training program.

Which of the following questions should be considered during the lessons-learned phase to most likely reduce the risk of reoccurrence? (Choose two.)

1. Are there opportunities for legal recourse against the originators of the spear-phishing campaign?
2. What internal and external stakeholders need to be notified of the breach?
3. Which methods can be implemented to increase speed of offline backup recovery?
4. What measurable user behaviors were exhibited that contributed to the compromise?
5. Which technical controls, if implemented, would provide defense when user training fails?
6. Which user roles are most often targeted by spear phishing attacks?

Question 103

An incident response team is analyzing malware and observes the following:

• Does not execute in a sandbox

• No network IoCs

• No publicly known hash match

• No process injection method detected

Which of the following should the team do next to proceed with further analysis?

1. Use an online virus analysis tool to analyze the sample.
2. Check for an anti-virtualization code in the sample.
3. Utilize a new deployed machine to run the sample.
4. Search other internal sources for a new sample.

Question 104

During an adversarial simulation exercise, an external team was able to gain access to sensitive information and systems without the organization detecting this activity.

Which of the following mitigation strategies should the organization use to best resolve the findings?

1. Configuring a honeypot for adversary characterization
2. Leveraging simulators for attackers
3. Setting up a honey network for attackers
4. Utilizing decoy accounts and documents

Question 105

A company is rewriting a vulnerable application and adding the mprotect() system call in multiple parts of the application's code that was being leveraged by a recent exploitation tool.

Which of the following should be enabled to ensure the application can leverage the new system call against similar attacks in the future?

1. TPM
2. Secure boot
3. NX bit
4. HSM

Question 106

An organization recently migrated data to a new file management system. The architect decides to use a discretionary authorization model on the new system.

Which of the following best explains the architect’s choice?

1. The responsibility of migrating data to the new file management system was outsourced to the vendor providing the platform.
2. The permissions were not able to be migrated to the new system, and several stakeholders were made responsible for granting appropriate access.
3. The legacy file management system did not support modern authentication techniques despite the business requirements.
4. The data custodians were selected by business stakeholders to ensure backups of the file management system are maintained off site.

Question 107

A company runs a DAST scan on a web application. The tool outputs the following recommendations:

• Use Cookie prefixes.

• Content Security Policy - SameSite=strict is not set.

Which of the following vulnerabilities has the tool identified?

1. RCE
2. XSS
3. CSRF
4. TOCTOU

Question 108

A retail organization wants to properly test and verify its capabilities to detect and/or prevent specific TTPs as mapped to the MITRE ATTACK framework specific to APTs.

Which of the following should be used by the organization to accomplish this goal?

1. Tabletop exercise
2. Penetration test
3. Sandbox detonation
4. Honeypot

Question 109

A manufacturing plant is updating its IT services. During discussions, the senior management team created the following list of considerations:

• Staff turnover is high and seasonal.

• Extreme conditions often damage endpoints.

• Losses from downtime must be minimized.

• Regulatory data retention requirements exist.

Which of the following best addresses the considerations?

1. Establishing further environmental controls to limit equipment damage
2. Using a non-persistent virtual desktop interface with thin clients
3. Deploying redundant file servers and configuring database journaling
4. Maintaining an inventory of spare endpoints for rapid deployment

Question 110

A game developer wants to reach new markets and is advised by legal counsel to include specific age-related sign-up requirements.

Which of the following best describes the legal counsel's concerns?

1. GDPR
2. LGPD
3. PCI DSS
4. COPPA

Question 111

A company hired a third-party consultant to run a cybersecurity incident simulation in order to identify security gaps and prepare stakeholders for a potential incident.

Which of the following best describes this activity?

1. Tabletop exercise
2. Walk-through review
3. Lessons learned
4. Business impact analysis

Question 112

A company wants to protect against the most common attacks and rapidly integrate with different programming languages.

Which of the following technologies is most likely to meet this need?

1. RASP
2. Cloud-based IDE
3. DAST
4. NIPS

Question 113

An organization is concerned about insider threats from employees who have individual access to encrypted material.

Which of the following techniques best addresses this issue?

1. SSO with MFA
2. Salting and hashing
3. Account federation with hardware tokens
4. SAE
5. Key splitting

Question 114

A development team must create a website to share indicators of compromise. The team wants to use APIs between industry peers to aid in configuring SIEM and SOAR. The team needs to create a free tier of service, and the senior developer insists on configuring rate limiting.

Which of the following best describes the senior developer's reasoning?

1. To prevent password-spraying attacks on the services hosting the API
2. To limit the likelihood of resource exhaustion occurring on the API server
3. To address concerns the team has about API bandwidth utilization
4. To reduce attack surface exposure of the API endpoints connecting peers

Question 115

A user tried to access a web page at http://10.1.11. Previously the web page did not require authentication, and now the browser is prompting for credentials.

Which of the following actions would best prevent the issue from reoccurring and reduce the likelihood of credential exposure?

1. Implementing 802.1x EAP-TTLS on access points to reduce the risk of evil twins
2. Transitioning internal services to use DNS security
3. Modifying web server configuration and utilizing X509 certificates for authentication
4. Installing new rules for the IDS to detect impersonation attacks

Question 116

Which of the following is the reason why security engineers often cannot upgrade the security of embedded facility automation systems?

1. They are constrained by available compute.
2. They lack x86-64 processors.
3. They lack EEPROM.
4. They are not logic-bearing devices.

Question 117

Which of the following AI concerns is most adequately addressed by input sanitization?

1. Model inversion
2. Prompt injection
3. Data poisoning
4. Non-explainable model

Question 118

A security researcher tells a company that one of its solutions is vulnerable to buffer overflow, leading to a malicious coding execution.

Which of the following is the best way to avoid this vulnerability in future versions?

1. Testing for CSRF vulnerabilities before the application goes to production
2. Using SAST tools to find vulnerabilities as part of the pipeline
3. Implementing canary protection in an earlier life-cycle stage
4. Implementing pair programming to improve development capabilities

Question 119

An organization determined its preparedness for a ransomware attack is inadequate. A security administrator is working on ways to improve and monitor the organization's response to ransomware attacks.

Which of the following is the best action for the administrator to take?

1. Conduct backup testing.
2. Define the recovery point objective.
3. Perform a business impact analysis.
4. Verify the encryption key length.

Question 120

A company implemented a new NAC solution based on 802.1X. However, the IT support team notices that some devices are not being enrolled in the new policies, causing access disruptions for key users.

Which of the following solutions will most likely solve this issue and prevent reoccurrence?

1. Include the monitoring agent and digital certificate as part of the patching/updating program, keeping all the corporate devices updated and enrolled.
2. Check whether the certificate is signed by a certification authority and manually deployed to each device.
3. Check all the devices without proper access, enrolling them via the solution agent and authenticating to the network.
4. Implement default credentials to automate RADIUS authentication and grant access to the network if the device owner is an employee.