Following a secure deployment methodology for custom applications, early code testing
would run in which type of environment? - ANSWER Development
Determine a solution that can combine with a cloud access security broker (CASB) to provide
a wholly cloud-hosted platform for client access? - ANSWER Next-generation secure
web gateway
Consider the principles of web server hardening and determine which actions a system
administrator should take when deploying a new server. (Select all that apply.) -
ANSWER Establish a guest zone
Upload files using SSH
Use configuration templates
A user used an administrator account to download and install a software application. After
the user launched the .exe extension installer file, the user experienced frequent crashes,
slow computer performance, and strange services running when turning on the computer.
What most likely happened to cause these issues? - ANSWER The user installed Trojan
horse malware.
A security operations center (SOC) analyst investigates the propagation of a memory-
resident virus across the network and notices a rapid consumption of network bandwidth,
causing a Denial of Service (DoS). What type of virus is this? - ANSWER A worm
A user purchased a laptop from a local computer shop. After powering on the laptop for the
first time, the user noticed a few programs like Norton Antivirus asking for permission to
1
,install. How would an IT security specialist classify these programs? - ANSWER PUP
(potentially unwanted program)
A fileless malicious software can replicate between processes in memory on a local host or
over network shares. What other behaviors and techniques would classify malware as
fileless rather than a normal virus? (Select all that apply.) - ANSWER -Uses lightweight
shellcode
-Uses low observable characteristic attacks
An attacker is planning to setup a backdoor that will infect a set of specific computers at an
organization, to inflict a set of other intrusion attacks remotely. Which of the following will
support the attackers' plan? (Select all that apply.) - ANSWER -Computer Bots,
-Command & Control
If a user's computer becomes infected with a botnet, which of the following can this
compromise allow the attacker to do? (Select all that apply.) - ANSWER -Launch a
Distributed Denial of Service (DDoS) attack
-Establish a connection with a Command and Control server
-Launch a mass-mail spam attack
If a user's device becomes infected with crypto-malware, which of the following is the best
way to mitigate this compromise? - ANSWER Have up-to-date backups.
During an internal investigation, a security specialist discovered a malicious backdoor script
on a system administrator's machine that executes if the admin's account becomes disabled.
What type of malware did the specialist discover? - ANSWER A logic bomb
End-users at an organization contact the cybersecurity department. After downloading a file,
they are being redirected to shopping websites they did not intend to navigate to, and built-
in webcams turn on. The security team confirms the issue as malicious, and notes modified
DNS (Domain Name System) queries that go to nefarious websites hosting malware. What
2
, most likely happened to the users' computers? - ANSWER Spyware infected the
computers.
An attacker installs Trojan malware that can execute remote backdoor commands, such as
the ability to upload files and install software to a victim PC. What type of Trojan malware is
this? - ANSWER A Remote Access Trojan (RAT)
A hacker is trying to gain remote access to a company computer by trying brute force
password attacks using a few common passwords in conjunction with multiple usernames.
What specific type of password attack is the hacker most likely performing? -
ANSWER Password spraying attack
An attacker can exploit a weakness in a password protocol to calculate the hash of a
password. Which of the following can the attacker match the hash to, as a means to obtain
the password? (Select all that apply.) - ANSWER -A rainbow table
-A dictionary word
Which of the following attacks do security professionals expose themselves to, if they do not
salt passwords with a random value? - ANSWER A rainbow table attack
How can an attacker make unauthorized use of acquired user and account details from a
user's smart card? - ANSWER Clone it.
What type of attack is occurring when a counterfeit card reader is in use? -
ANSWER Skimming
An attacker discovered an input validation vulnerability on a website, crafted a URL with
additional HTML code, and emailed the link to a victim. The victim unknowingly defaced
(vandalized) the web site after clicking on the malicious URL. No other malicious operations
occurred outside of the web application's root directory. This scenario is describing which
type of attack? - ANSWER Cross-site scripting (XSS)
3
would run in which type of environment? - ANSWER Development
Determine a solution that can combine with a cloud access security broker (CASB) to provide
a wholly cloud-hosted platform for client access? - ANSWER Next-generation secure
web gateway
Consider the principles of web server hardening and determine which actions a system
administrator should take when deploying a new server. (Select all that apply.) -
ANSWER Establish a guest zone
Upload files using SSH
Use configuration templates
A user used an administrator account to download and install a software application. After
the user launched the .exe extension installer file, the user experienced frequent crashes,
slow computer performance, and strange services running when turning on the computer.
What most likely happened to cause these issues? - ANSWER The user installed Trojan
horse malware.
A security operations center (SOC) analyst investigates the propagation of a memory-
resident virus across the network and notices a rapid consumption of network bandwidth,
causing a Denial of Service (DoS). What type of virus is this? - ANSWER A worm
A user purchased a laptop from a local computer shop. After powering on the laptop for the
first time, the user noticed a few programs like Norton Antivirus asking for permission to
1
,install. How would an IT security specialist classify these programs? - ANSWER PUP
(potentially unwanted program)
A fileless malicious software can replicate between processes in memory on a local host or
over network shares. What other behaviors and techniques would classify malware as
fileless rather than a normal virus? (Select all that apply.) - ANSWER -Uses lightweight
shellcode
-Uses low observable characteristic attacks
An attacker is planning to setup a backdoor that will infect a set of specific computers at an
organization, to inflict a set of other intrusion attacks remotely. Which of the following will
support the attackers' plan? (Select all that apply.) - ANSWER -Computer Bots,
-Command & Control
If a user's computer becomes infected with a botnet, which of the following can this
compromise allow the attacker to do? (Select all that apply.) - ANSWER -Launch a
Distributed Denial of Service (DDoS) attack
-Establish a connection with a Command and Control server
-Launch a mass-mail spam attack
If a user's device becomes infected with crypto-malware, which of the following is the best
way to mitigate this compromise? - ANSWER Have up-to-date backups.
During an internal investigation, a security specialist discovered a malicious backdoor script
on a system administrator's machine that executes if the admin's account becomes disabled.
What type of malware did the specialist discover? - ANSWER A logic bomb
End-users at an organization contact the cybersecurity department. After downloading a file,
they are being redirected to shopping websites they did not intend to navigate to, and built-
in webcams turn on. The security team confirms the issue as malicious, and notes modified
DNS (Domain Name System) queries that go to nefarious websites hosting malware. What
2
, most likely happened to the users' computers? - ANSWER Spyware infected the
computers.
An attacker installs Trojan malware that can execute remote backdoor commands, such as
the ability to upload files and install software to a victim PC. What type of Trojan malware is
this? - ANSWER A Remote Access Trojan (RAT)
A hacker is trying to gain remote access to a company computer by trying brute force
password attacks using a few common passwords in conjunction with multiple usernames.
What specific type of password attack is the hacker most likely performing? -
ANSWER Password spraying attack
An attacker can exploit a weakness in a password protocol to calculate the hash of a
password. Which of the following can the attacker match the hash to, as a means to obtain
the password? (Select all that apply.) - ANSWER -A rainbow table
-A dictionary word
Which of the following attacks do security professionals expose themselves to, if they do not
salt passwords with a random value? - ANSWER A rainbow table attack
How can an attacker make unauthorized use of acquired user and account details from a
user's smart card? - ANSWER Clone it.
What type of attack is occurring when a counterfeit card reader is in use? -
ANSWER Skimming
An attacker discovered an input validation vulnerability on a website, crafted a URL with
additional HTML code, and emailed the link to a victim. The victim unknowingly defaced
(vandalized) the web site after clicking on the malicious URL. No other malicious operations
occurred outside of the web application's root directory. This scenario is describing which
type of attack? - ANSWER Cross-site scripting (XSS)
3
