CYSA Dion Training UPDATED ACTUAL Questions and CORRECT Answers
• TLS -
Transport Layer Security (TLS) is a widely adopted security
Which of the following types of encryption would ensure
protocol designed to facilitate privacy and data security
the best security of a website?
for communications over the internet. A primary use case
• SSLv1
of TLS is encrypting the communication between web
• SSLv2
applications and servers, such as web browsers loading
• SSLv3
a website. TLS was developed in 1999 as SSLv3.1, but its
• TLS
name was changed to separate itself from Netscape, who
developed the original SSL protocol.
In your role as a cybersecurity consultant, your client
• Authentication Tokens -
wants to augment their authentication protocols to boost
Authentication tokens are a form of passwordless au-
security while reducing the reliance on traditional pass-
thentication. These tokens provide a unique, temporary
words. Which authentication strategy would BEST meet
code that authenticates the user's identity. This method
these requirements?
increases security as it reduces the reliance on memo-
• Authentication Tokens
rized passwords and is less susceptible to traditional pass-
• Password Complexity Rules
word-based attacks.
Security Questions
• Connecting to the host using a null session allows enu-
What best describes the meaning of this output? meration of the share names on the host -
• There is an unknown bug in an Apache server with no This is the result of a vulnerability scan that conducted
Bugtraq ID an enumeration of open Windows shares on an Apache
• Connecting to the host using a null session allows enu- server. The enumeration results show three share names
meration of the share names on the host (print$, files, Temp), that have been found using a null
• Windows Defender has a known exploit that must be session connection. There is no associated CVE with this
resolved or patched vulnerability, but it is not a false positive. Not all vulnera-
There is no CVE present, so this is a false positive caused bilities have a CVE associated with them. Nothing in this
by Apache running on a Windows serverrrently operating. output indicates anything concerning Windows Defender,
SSH operates over port 22. Web servers use port 80 for so this is not the correct answer. Bugtraq IDs are a different
HTTP and 443 for HTTPS. Database servers run on port type of identification number issued for vulnerabilities by
SecurityFocus.
,1433 (Microsoft SQL) or 3306 (MySQL). Remote Desktop
Protocol runs on
A company's NetFlow collection system can handle up to 2
Gbps. Due to excessive load, this has begun to approach
full utilization at various times of the day. If the security
Enable sampling of the data
team does not have additional money in their budget to
purchase a more capable collector, which of the following
options could they use to collect useful data?
Which of the following frameworks is commonly used for
sharing threat intelligence information in a standardized (STIX)Structures Threat Information Expression
format?
In which phase of the security intelligence cycle is in-
put collected from intelligence producers and consumers
Feedback
to improve the implementation of intelligence require-
ments?
Which of the following is an example of an open-source
intelligence feed? • IBM X-Force Exchange
• Recorded Future Malware Information Sharing Project
• FireEye
• Malware Information Sharing Project
Advanced Persistent Threat -Advanced Persistent Threat
Which of the following types of attackers are considered to
(APT) attackers are sophisticated and have access to fi-
be a sophisticated and highly organized person or team
nancial and technical resources typically provided by a
who are typically sponsored by a nation-state?
government. An APT is an attacker with the ability to obtain,
Script Kiddie
maintain, and diversify access to network systems using
• Advanced Persistent Threat
exploits and malware.
, • Hacktivist
• Ethical Hacker
Which type of threat will patches NOT effectively combat
as a security control?
• Zero-day attacks
Zero-Day Attacks
• Known vulnerabilities
• Discovered software bugs
• Malware with defined indicators of compromise
In the Cyber Kill Chain model, at which stage does an
attacker take advantage of a system's vulnerabilities using
Exploitation
the malicious payload that has been delivered, thereby
initiating the actual attack?
What is the utilization of insights gained from threat re-
search and threat modeling to proactively discover ev-
idence of adversarial TTPs within a network or system
called?
Threat hunting
• Incident response
• Penetration testing
• Threat hunting
• Information assurance
The utilization of insights gained from threat research
Threat hunting and threat modeling to proactively discover evidence of
adversarial TTPs within a network or system.
Contains information not indexed by standard search en-
gines - The Deep Web contains information that is not
Which of the following is a characteristic of the Deep Web?
indexed by standard search engines, making it invisible to
conventional searches.
A cybersecurity analyst is reviewing the logs
of a proxy server and saw the following
URL, https://www.google.com/search?q=*%40diontrain-
, ing.com. Which of the following is true about the results Returns all web pages containing an email address aflli-
of this search? ated with diontraining.com
You are a cybersecurity analyst investigating a poten-
tial network issue at your company. You suspect there
is unusual traflc on your company's network. Which of
Tcpdump
the following would be most effective command-line for
capturing and analyzing network packets in real-time to
investigate this issue?
- tcpdump is a powerful command-line tool used for cap-
turing and analyzing network packets in real-time, which
Tcpdump
would be effective for investigating unusual network traf-
fic.
A cybersecurity analyst is attempting to perform an active
reconnaissance technique to audit their company's secu-
rity controls. Which DNS assessment technique would be
classified as active?
A zone transfer
• A DNS forward or reverse lookup
• A zone transfer
• A whois query
• Using maltego
In DNS, the act of copying a primary name server's zone
zone transfer file to the secondary name server to ensure that both
contain the same information.
Which technique would provide the largest increase in
security on a network with ICS, SCADA, or IoT devices?
• Installation of anti-virus tools
User and entity behavior analytics
• Use of a host-based IDS or IPS
• Implement endpoint protection platforms
• User and entity behavior analytics
User and Entity Behavior Analytics (UEBA)
• TLS -
Transport Layer Security (TLS) is a widely adopted security
Which of the following types of encryption would ensure
protocol designed to facilitate privacy and data security
the best security of a website?
for communications over the internet. A primary use case
• SSLv1
of TLS is encrypting the communication between web
• SSLv2
applications and servers, such as web browsers loading
• SSLv3
a website. TLS was developed in 1999 as SSLv3.1, but its
• TLS
name was changed to separate itself from Netscape, who
developed the original SSL protocol.
In your role as a cybersecurity consultant, your client
• Authentication Tokens -
wants to augment their authentication protocols to boost
Authentication tokens are a form of passwordless au-
security while reducing the reliance on traditional pass-
thentication. These tokens provide a unique, temporary
words. Which authentication strategy would BEST meet
code that authenticates the user's identity. This method
these requirements?
increases security as it reduces the reliance on memo-
• Authentication Tokens
rized passwords and is less susceptible to traditional pass-
• Password Complexity Rules
word-based attacks.
Security Questions
• Connecting to the host using a null session allows enu-
What best describes the meaning of this output? meration of the share names on the host -
• There is an unknown bug in an Apache server with no This is the result of a vulnerability scan that conducted
Bugtraq ID an enumeration of open Windows shares on an Apache
• Connecting to the host using a null session allows enu- server. The enumeration results show three share names
meration of the share names on the host (print$, files, Temp), that have been found using a null
• Windows Defender has a known exploit that must be session connection. There is no associated CVE with this
resolved or patched vulnerability, but it is not a false positive. Not all vulnera-
There is no CVE present, so this is a false positive caused bilities have a CVE associated with them. Nothing in this
by Apache running on a Windows serverrrently operating. output indicates anything concerning Windows Defender,
SSH operates over port 22. Web servers use port 80 for so this is not the correct answer. Bugtraq IDs are a different
HTTP and 443 for HTTPS. Database servers run on port type of identification number issued for vulnerabilities by
SecurityFocus.
,1433 (Microsoft SQL) or 3306 (MySQL). Remote Desktop
Protocol runs on
A company's NetFlow collection system can handle up to 2
Gbps. Due to excessive load, this has begun to approach
full utilization at various times of the day. If the security
Enable sampling of the data
team does not have additional money in their budget to
purchase a more capable collector, which of the following
options could they use to collect useful data?
Which of the following frameworks is commonly used for
sharing threat intelligence information in a standardized (STIX)Structures Threat Information Expression
format?
In which phase of the security intelligence cycle is in-
put collected from intelligence producers and consumers
Feedback
to improve the implementation of intelligence require-
ments?
Which of the following is an example of an open-source
intelligence feed? • IBM X-Force Exchange
• Recorded Future Malware Information Sharing Project
• FireEye
• Malware Information Sharing Project
Advanced Persistent Threat -Advanced Persistent Threat
Which of the following types of attackers are considered to
(APT) attackers are sophisticated and have access to fi-
be a sophisticated and highly organized person or team
nancial and technical resources typically provided by a
who are typically sponsored by a nation-state?
government. An APT is an attacker with the ability to obtain,
Script Kiddie
maintain, and diversify access to network systems using
• Advanced Persistent Threat
exploits and malware.
, • Hacktivist
• Ethical Hacker
Which type of threat will patches NOT effectively combat
as a security control?
• Zero-day attacks
Zero-Day Attacks
• Known vulnerabilities
• Discovered software bugs
• Malware with defined indicators of compromise
In the Cyber Kill Chain model, at which stage does an
attacker take advantage of a system's vulnerabilities using
Exploitation
the malicious payload that has been delivered, thereby
initiating the actual attack?
What is the utilization of insights gained from threat re-
search and threat modeling to proactively discover ev-
idence of adversarial TTPs within a network or system
called?
Threat hunting
• Incident response
• Penetration testing
• Threat hunting
• Information assurance
The utilization of insights gained from threat research
Threat hunting and threat modeling to proactively discover evidence of
adversarial TTPs within a network or system.
Contains information not indexed by standard search en-
gines - The Deep Web contains information that is not
Which of the following is a characteristic of the Deep Web?
indexed by standard search engines, making it invisible to
conventional searches.
A cybersecurity analyst is reviewing the logs
of a proxy server and saw the following
URL, https://www.google.com/search?q=*%40diontrain-
, ing.com. Which of the following is true about the results Returns all web pages containing an email address aflli-
of this search? ated with diontraining.com
You are a cybersecurity analyst investigating a poten-
tial network issue at your company. You suspect there
is unusual traflc on your company's network. Which of
Tcpdump
the following would be most effective command-line for
capturing and analyzing network packets in real-time to
investigate this issue?
- tcpdump is a powerful command-line tool used for cap-
turing and analyzing network packets in real-time, which
Tcpdump
would be effective for investigating unusual network traf-
fic.
A cybersecurity analyst is attempting to perform an active
reconnaissance technique to audit their company's secu-
rity controls. Which DNS assessment technique would be
classified as active?
A zone transfer
• A DNS forward or reverse lookup
• A zone transfer
• A whois query
• Using maltego
In DNS, the act of copying a primary name server's zone
zone transfer file to the secondary name server to ensure that both
contain the same information.
Which technique would provide the largest increase in
security on a network with ICS, SCADA, or IoT devices?
• Installation of anti-virus tools
User and entity behavior analytics
• Use of a host-based IDS or IPS
• Implement endpoint protection platforms
• User and entity behavior analytics
User and Entity Behavior Analytics (UEBA)
