CSAPL Final Exam Latest Updated Graded A+

You are assisting a customer with improvements to their configuration and vulnerability management processes. Which organization produces multi-vendor benchmarks to assist the development of configuration baselines? SOC CIS EAP CASB - ANSWER CIS A network engineer is reviewing a recent vulnerability report from a colleague. The report conclusively contains many false positives related to hosts that another colleague debunked recently as non-issues. How can the network engineer manage information in later reports so that the team focuses on real vulnerabilities and threats? Select all that apply. Exclude hosts Use exceptions Remediate the exploit Change priority - ANSWER Exclude hosts Use exceptions Change priority An IT engineer performs a security analysis of monitoring data. For reporting purposes, the analyst focuses on a volume-based trend analysis approach. Review the possibilities and conclude which approach the analyst practices? Acquire the sum of all values, divided by the number of samples Establish a baseline for a metric, for a specific log event, per hour of the day Determine if logs are growing much faster than they were previously Refer to narrative-based threat awareness and intelligence - ANSWER Determine if logs are growing much faster than they were previously A specialized system requires elevated security requirements from other systems on the network. To accomplish this, the admin uses a VLAN for the system. Considering the technique, what isolation type did admin use? Demilitarized zone Physical segmentation Virtual segmentation Air gap - ANSWER Virtual segmentation IT security experts are examining a system that was part of a security breach. The experts determine that port forwarding was a key element in the attack. Which technique do the experts conclude the attacker uses? Lateral Pivoting Steganography Pagefile - ANSWER Pivoting Which system type features a combined architecture that includes controllers, processors, and more? Controller System-on-chip Embedded Field programmable gate array - ANSWER System-on-chip A security firm conducts a process of risk identification and assessment. Using NIST's Managing Information Security Risk principles as a guide, which area does the firm outline that identifies eliminating negative change as an overall goal? Assess Frame Respond Monitor - ANSWER Frame Engineers at a company feel that a rogue system exists on a corporate network. The engineers determine that capturing packets may help identify the system. Compare the device types and conclude which of the following the engineers utilize. Smart appliance Honeypot Virtual Machine Network tap - ANSWER Network tap A developer seeks to automate the development process for a web application development. Which phase does the developer create a sandbox environment for? Development Staging Test Integration - ANSWER Development An IT expert troubleshoots an email server issue for security purposes. During troubleshooting, the expert discovers that SMTP logs indicate that the service is not available. Which code indicates this type of issue? 421 250 220 443 - ANSWER 421 Users of a popular software package discover that a vulnerability exists. The malware exploits the vulnerability before the vendor can issue a patch to fix it. The malware is known as which type of threat? Zero-day Commodity Sabotage Custom - ANSWER Zero-day A cybersecurity firm provides contracted penetration testing by using a variety of functional exercises. A specialist at the firm decides to use a war game approach and creates teams. The specialist needs to select a team to intervene if the game escalates too far. Which team does the firm assign to this role? Rogue Blue White Red - ANSWER White An IT manager is performing vendor due diligence with a new server supplier. Of the given choices, which are valid standards? Select all that apply. Cybersecurity risk management program Hardware source authenticity Trusted platform Financial and regulatory reliability - ANSWER Cybersecurity risk management program Financial and regulatory reliability Numerous energy companies experience cyber attacks in a short period of time. Analysts that investigate the attacks categorize the threats as coming from which actor type? Nation-state Organized crime Hacktivist Shadow IT - ANSWER Nation-state An IT administrator identifies a service interruption on a server through system and application log files and alerts. Users are not able to obtain an IP address and the network is unresponsive. Which issue may be causing the problem? An adversary is preventing a service from running. The server has logged attempts to access a resource. Malware may have compromised an authorized service. An attack may have disrupted a service. - ANSWER An attack may have disrupted a service. An administrator discovers, through a system scan, that a server's NetBIOS ports are still vulnerable to attack. The server's firewall rules are currently blocking all applicable NetBIOS UDP ports. Which NetBIOS TCP port must the administrator add to the server's list of firewall rules to block? 123 139 137 135 - ANSWER 139 Cybersecurity analysts are considering a feasible approach to restoring a compromised cloud-based virtual machine. All systems are based on templates. Which approach do the analysts utilize? Reimage Reconstitution Sanitization Containment - ANSWER Reimage To avoid using hard-coded IP ranges, some malware will switch to dynamically-generated domains by using an algorithm. This algorithm, used along with another technique, can continually change an IP address that a domain resolves to. Which technique would accomplish this? Fast flux network Domain generation algorithm Dynamic DNS Recursive queries - ANSWER Fast flux network A user makes changes to directory permissions on a Linux system. Which of the given choices allows a group the read and write permissions? d rw- r-x r-x home d rwx r-x rw- home d r-x r-- rw- home d r-- rwx r-- home - ANSWER d r-- rwx r-- home While performing maintenance on one server, an engineer notices that a server database is much smaller in size than usual. The engineer suspects an exploit with the Simple Object Access Protocol (SOAP). Evaluate the exploit types and determine which an attacker may be using. Coercive parsing Probing SQL injection External references - ANSWER SQL injection There are different levels of data privacy categorization that follow military usage. Which level has the highest privacy rating? Secret Top-secret Confidential Classified - ANSWER Top-secret Which framework may base a large portion of its findings from internal assessment results rather than by best-practice standard input? Prescriptive Regulatory Risk-based Governance - ANSWER Risk-based A Windows server does not recognize some internal hardware. IT staff suspect malicious activity has impacted the system. An administrator utilizes event logs to research any irregular activity. Which log identifies events of faulty system devices and drivers? Security System Application Setup - ANSWER System The systems administrator for a medium-sized company manages a bring your own device (BYOD) program. There is concern about device misplacement and theft with small mobile devices, such as tablets and phones. Which area is the administrator concerned with? Select all that apply. Unencrypted data Managing software patches Network strain Bringing work home - ANSWER Unencrypted data Bringing work home Public relations personnel for a technology company release a statement regarding a recent breach. The statement describes the incident as an occurrence of data exfiltration. Evaluate the following statements and determine which one PR uses as a source of information. A misconfiguration leads to making data public. An attack that compromises the availability of data systems processing. A transfer of private data to an unknown system. An ex-employee with remaining privileges, compromises data systems. - ANSWER A transfer of private data to an unknown system. IT staff revamp an Active Directory implementation of folder permissions that uses group policy. The staff references user responsibilities in the company when creating permissions. Which control type does the staff focus on? Discretionary access control Role-based access control Mandatory access control Attribute-based access control - ANSWER Role-based access control Evaluate the possibilities and determine which stage an attacker uses a value system to target data. Strengthen access Concealment Action on objectives Maintain access - ANSWER Action on objectives An attack has compromised a virtualized server. Security experts perform forensic activity as part of a recovery effort. The experts conclude that the attack incrementally occurred over time. Evaluate the given challenges and determine which the experts face. Logs stored on the instances themselves will be missing. Security must merge any checkpoints to the main image, using a hypervisor tool. File formats used by some hypervisors require conversion first. The attack widely fragmented the image across the host file system. - ANSWER Security must merge any checkpoints to the main image, using a hypervisor tool An IT engineer decides to standardize on regular expression (regex) syntax when writing Security Information and Event Management (SIEM) correlation rules. The engineer needs to specify a match at the start of a line. Which syntax elements does the engineer use to accomplish this goal? $ ^ {} ? - ANSWER ^ Which system's implementation utilizes a minimal client operating system environment? Containerization Virtualization host Virtual desktop infrastructure Virtual machine - ANSWER Virtual desktop infrastructure To reduce overall systems monitoring effort, an engineer increases the hardening of all workstations. Which approach ensures that unused hardware components do not become a security concern? Disable services Enforce an ACL Disable devices Disable accounts - ANSWER Disable devices Analysts are deploying a new IT infrastructure with enhanced security controls. Stakeholders show concern for the state of the deployment as it is behind schedule. Of the given choices, stakeholders show concern in what area? Prescriptive Governance Risk-based Regulatory - ANSWER Governance It is important to assess sources when adding information to a data set. Considering threat intelligence, this data is likely to derive from external sources. Which factor is key in disseminating updates? Confidence levels Relevancy Accuracy Timeliness - ANSWER Timeliness Users at a company report that computers are suddenly acting strangely. An IT engineer suspects persistent malicious activity. Which areas does the engineer investigate? Select all that apply. Scheduled tasks Disabled devices Cron jobs Failed logins - ANSWER Scheduled tasks Cron jobs A user tries to copy a sensitive file in the office. Since a data loss prevention service is in place, the attempt fails. The user states that access to the file is missing and a warning message appears. Which data loss prevention remediation method is the user describing? Quarantine Block Tombstone Alert - ANSWER Tombstone Threat intelligence reveals a new type of malware is infecting Windows desktops in many companies. Security specialists at a company initiate threat hunting activities to investigate a potential infection. Which areas do the engineers investigate in implementing the hunt? Select all that apply. Network traffic Data acquisition Process lists Data exfiltration - ANSWER Network traffic Process lists Which issues may complicate a cloud-based forensics investigation? Select all that apply. Incorrect origin settings Chain of custody Data recovery Data sovereignty - ANSWER Chain of custody Data recovery Data sovereignty A systems administrator configures syslog to collect system events on a network. The admin's past experience with an older implementation of syslog did not go so well, as messages were lost on the network. Currently, the admin is configuring the syslog and notices it works quite well. Which of the following technologies did the systems admin utilize? Select all that apply. UDP HTTPS TCP TLS - ANSWER TCP TLS A disgruntled employee copied personnel files and uploaded them to a public FTP site. The employee's contract was terminated and an offboarding process completed to revoke their permissions. Which terms define this attack? Select all that apply. Organized crime Persistent Intentional Insider - ANSWER Intentional Insider An organization implements password policies to tighten security. Which policy is NOT considered deprecated? Complexity Challenge questions Aging policies 2-step verification - ANSWER 2-step verification An analyst needs to rate a vulnerability as 7.0+ using Common Vulnerability Scoring System (CVSS) metrics. Which score does the analyst choose? Medium High Critical Scope - ANSWER High An engineer configures an intrusion detection system to create alerts when it finds a security issue. A variety of output formats are available. The engineer chooses a format that allows the output file to be easily read in Microsoft Excel. Which format does the engineer decide to use? Unified output Comma-separated values Tcpdump Syslog - ANSWER Comma-separated values