CSAPL Final questions with complete
solutions graded A+
You are assisting a customer with improvements to their configuration and vulnerability management
processes. Which organization produces multi-vendor benchmarks to assist the development of
configuration baselines?
SOC
CIS
EAP
CASB - correct answer ✔✔CIS
A network engineer is reviewing a recent vulnerability report from a colleague. The report conclusively
contains many false positives related to hosts that another colleague debunked recently as non-issues.
How can the network engineer manage information in later reports so that the team focuses on real
vulnerabilities and threats? Select all that apply.
Exclude hosts
Use exceptions
Remediate the exploit
Change priority - correct answer ✔✔Exclude hosts
Use exceptions
Change priority
An IT engineer performs a security analysis of monitoring data. For reporting purposes, the analyst
focuses on a volume-based trend analysis approach. Review the possibilities and conclude which
approach the analyst practices?
Acquire the sum of all values, divided by the number of samples
Establish a baseline for a metric, for a specific log event, per hour of the day
Determine if logs are growing much faster than they were previously
,Refer to narrative-based threat awareness and intelligence - correct answer ✔✔Determine if logs are
growing much faster than they were previously
A specialized system requires elevated security requirements from other systems on the network. To
accomplish this, the admin uses a VLAN for the system. Considering the technique, what isolation type
did admin use?
Demilitarized zone
Physical segmentation
Virtual segmentation
Air gap - correct answer ✔✔Virtual segmentation
IT security experts are examining a system that was part of a security breach. The experts determine that
port forwarding was a key element in the attack. Which technique do the experts conclude the attacker
uses?
Lateral
Pivoting
Steganography
Pagefile - correct answer ✔✔Pivoting
Which system type features a combined architecture that includes controllers, processors, and more?
Controller
System-on-chip
Embedded
Field programmable gate array - correct answer ✔✔System-on-chip
A security firm conducts a process of risk identification and assessment. Using NIST's Managing
Information Security Risk principles as a guide, which area does the firm outline that identifies
eliminating negative change as an overall goal?
Assess
Frame
, Respond
Monitor - correct answer ✔✔Frame
Engineers at a company feel that a rogue system exists on a corporate network. The engineers determine
that capturing packets may help identify the system. Compare the device types and conclude which of
the following the engineers utilize.
Smart appliance
Honeypot
Virtual Machine
Network tap - correct answer ✔✔Network tap
A developer seeks to automate the development process for a web application development. Which
phase does the developer create a sandbox environment for?
Development
Staging
Test
Integration - correct answer ✔✔Development
An IT expert troubleshoots an email server issue for security purposes. During troubleshooting, the
expert discovers that SMTP logs indicate that the service is not available. Which code indicates this type
of issue?
421
250
220
443 - correct answer ✔✔421
Users of a popular software package discover that a vulnerability exists. The malware exploits the
vulnerability before the vendor can issue a patch to fix it. The malware is known as which type of threat?
Zero-day
Commodity
Sabotage
solutions graded A+
You are assisting a customer with improvements to their configuration and vulnerability management
processes. Which organization produces multi-vendor benchmarks to assist the development of
configuration baselines?
SOC
CIS
EAP
CASB - correct answer ✔✔CIS
A network engineer is reviewing a recent vulnerability report from a colleague. The report conclusively
contains many false positives related to hosts that another colleague debunked recently as non-issues.
How can the network engineer manage information in later reports so that the team focuses on real
vulnerabilities and threats? Select all that apply.
Exclude hosts
Use exceptions
Remediate the exploit
Change priority - correct answer ✔✔Exclude hosts
Use exceptions
Change priority
An IT engineer performs a security analysis of monitoring data. For reporting purposes, the analyst
focuses on a volume-based trend analysis approach. Review the possibilities and conclude which
approach the analyst practices?
Acquire the sum of all values, divided by the number of samples
Establish a baseline for a metric, for a specific log event, per hour of the day
Determine if logs are growing much faster than they were previously
,Refer to narrative-based threat awareness and intelligence - correct answer ✔✔Determine if logs are
growing much faster than they were previously
A specialized system requires elevated security requirements from other systems on the network. To
accomplish this, the admin uses a VLAN for the system. Considering the technique, what isolation type
did admin use?
Demilitarized zone
Physical segmentation
Virtual segmentation
Air gap - correct answer ✔✔Virtual segmentation
IT security experts are examining a system that was part of a security breach. The experts determine that
port forwarding was a key element in the attack. Which technique do the experts conclude the attacker
uses?
Lateral
Pivoting
Steganography
Pagefile - correct answer ✔✔Pivoting
Which system type features a combined architecture that includes controllers, processors, and more?
Controller
System-on-chip
Embedded
Field programmable gate array - correct answer ✔✔System-on-chip
A security firm conducts a process of risk identification and assessment. Using NIST's Managing
Information Security Risk principles as a guide, which area does the firm outline that identifies
eliminating negative change as an overall goal?
Assess
Frame
, Respond
Monitor - correct answer ✔✔Frame
Engineers at a company feel that a rogue system exists on a corporate network. The engineers determine
that capturing packets may help identify the system. Compare the device types and conclude which of
the following the engineers utilize.
Smart appliance
Honeypot
Virtual Machine
Network tap - correct answer ✔✔Network tap
A developer seeks to automate the development process for a web application development. Which
phase does the developer create a sandbox environment for?
Development
Staging
Test
Integration - correct answer ✔✔Development
An IT expert troubleshoots an email server issue for security purposes. During troubleshooting, the
expert discovers that SMTP logs indicate that the service is not available. Which code indicates this type
of issue?
421
250
220
443 - correct answer ✔✔421
Users of a popular software package discover that a vulnerability exists. The malware exploits the
vulnerability before the vendor can issue a patch to fix it. The malware is known as which type of threat?
Zero-day
Commodity
Sabotage
