#1. An organization wants to perform a scan of all its systems against best practice security configurations. Which of the following SCAP standards, when combined, will enable the organization to view each of the configuration checks in a machine-readable checklist format for full automation? (Choose two.)
Select all that apply:
#2. A company is moving most of its customer-facing production systems to the cloud-facing production systems to the cloud. IaaS is the service model being used. The Chief Executive Officer is concerned about the type of encryption available and requires the solution must have the highest level of security. Which encryption methods should the cloud security engineer select during the implementation phase?
Instance store volumes (Amazon Web Services) – For IaaS customers
The data on NVMe instance store volumes is encrypted using an XTS-AES-256 cipher, implemented on a
hardware module on the instance. The keys used to encrypt data that’s written to locally-attached NVMe
storage devices are per-customer, and per volume. The keys are generated by, and only reside within, the
hardware module, which is inaccessible to AWS personnel.
Storage based would be Self Encrypting Hard Drive (SED)
#3. A software house is developing a new application. The application has the following requirements: (see exhibit) Which of the following is the BEST federation method to use for the application?
OpenID Connect: If you’ve used your Google to sign in to applications like YouTube, or Facebook to log into an online shopping cart, then you’re familiar with this authentication option. OpenID Connect is an open standard that organisations use to authenticate users. IdPs use this so that users can sign in to the IdP, and then access other websites and apps without having to log in or share their sign-in information. OpenID is a Federation service – sending JWT to authenticate the user with a 3rd party vendor site.
To Authorize your data being used by the vendor site you will also use Oauth
OAuth (Open Authorization[1][2]) is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.[3][4] This mechanism is used by companies such as Amazon,[5] Google, Facebook, Microsoft, and Twitter to permit the users to share information about their accounts with third-party applications or websites
#4. In preparation for a major sales promotion, a company redesigned the system that manages retail sales and moved it to a CSP. The new infrastructure did not meet the company's availability requirements. During the AAR process, the following issues were highlighted: (see exhibit). What infrastructure design would be BEST to avoid these issues in the future?
#5. A defence contractor recently experienced a ransomware attack. The CSO is concerned about the attack reoccurring. However, no further security measures have been implemented. What can be used to identify potential prevention recommendations?
NIST SP800-61
Preparation includes – Section 3.1.2 Preventing Incidents
Risk Assessments, Host Security, Network Security, User Awareness Training
#6. A company undergoing digital transformation is reviewing the resiliency of a CSP and is concerned about meeting SLA requirements in the event of a CSP incident. Which of the following would be BEST to proceed with the transformation?
#7. Acme corporation acquired the Perth Beer company. During an audit, it was found that Perth Beer Company systems were inadequately patched. In response, Acme placed a firewall between the two environments until Perth Beer could be integrated into Acme's security program. What risk-handling techniques was used?
#8. A CISO received a regulatory notice asking for information regarding collusion and pricing from staff members who are no longer with the organization. The legal department provided the CISO with a list of search terms to investigate. This is an example of:
#9. A security auditor needs to review the manner in which an entertainment device operates. The auditor is analyzing the output of a port scanning tool to determine the next steps in the security review. Given the following log output. (see exhibit) The best option for the auditor to use NEXT is:
#10. A company has decided to purchase a license for software that is used to operate a mission critical process. The third-party developer is new to the industry but is delivering what the company needs at this time. Which of the following BEST describes the reason why utilizing a source code escrow will reduce the operational risk to the company if the third party stops supporting the application?
#11. Jeff, a cybersecurity analyst, receives a ticket that indicates a potential incident is occurring. There has been a large increase in log files generated by a website containing a ''Contact US'' form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign or if this is a potential incident. What would BEST assist Jeff?
#12. The OS on several servers crashed around the same time for an unknown reason. The servers were restored to working condition, and all file integrity was verified. Which of the following should the incident response team perform to understand the crash and prevent it in the future?
#13. A company hired a third party to develop software as part of its strategy to be quicker to market. The company's policy outlines the following requirements: (see exhibit). What would be the BEST recommendation for storing and monitoring access to these shared credentials?
A Key Vault provides a way to securely store credentials and other keys and secrets, but your code needs to authenticate to Key Vault to retrieve them
#14. A recent data breach stemmed from unauthorized access to an employee's company account with a cloud-based productivity suite. The attacker exploited excessive permissions granted to a third-party OAuth application to collect sensitive information. What BEST mitigates inappropriate access and permissions issues?
CASBs were created with one thing in mind: protecting proprietary data stored in external, third-party media. CASBs deliver capabilities not generally available in traditional controls such as secure web gateways (SWGs) and enterprise firewalls. CASBs provide policy and governance concurrently across multiple cloud services and provide granular visibility into and control over user activities
#15. A company publishes several APIs for customers and is required to use keys to segregate customer data sets. Which of the following would be BEST to use to store customer keys?
#16. A security engineer was auditing an organization's current software development practice and discovered that multiple open-source libraries were Integrated into the organization's software. The organization currently performs SAST and DAST on the software it develops. Which of the following should the organization incorporate into the SDLC to ensure the security of the open-source libraries?
#17. A home automation company just purchased and installed tools for its SOC to enable incident identification and response on software the company develops. The company would like to prioritize defences against the following attack scenarios (see exhibit) Which actions will enable the data feeds needed to detect these types of attacks on development environments? (Choose two.)
Select all that apply:
#18. An organization recently started processing, transmitting, and storing its customers' credit card information. Within a week of doing so, the organization suffered a massive breach that resulted in the exposure of the customers' information. Which of the following provides the BEST guidance for protecting such information while it is at rest and in transit?
#19. A company requires that all mobile devices be encrypted, commensurate with the full disk encryption scheme of assets, such as workstation, servers, and laptops. Which of the following will MOST likely be a limiting factor when selecting mobile device managers for the company?
#20. Security Professionals are designing a system to mitigate recent setbacks caused by competitors that are beating the company to market with the new products. Many of the products incorporate propriety designs developed by the company. The network already includes a SEIM and a NIPS and requires 2FA for all user access. What else should be considered to mitigate the associated risks?
#21. Immediately following the report of a potential breach, a security engineer creates a forensic image of the server in question as part of the organization incident response procedure. Which of the must occur to ensure the integrity of the image?
#22. An organization is developing a disaster recovery plan that requires data to be backed up and available at a moment's notice. An organization is developing a disaster recovery plan that requires data to be backed up and available at a moment's notice.
Before we can design the detailed elements of BCDR (Business Continuity Disaster Recovery) we need to complete a comprehensive BIA (Business Impact Analysis/Assessment).
#23. A company is implementing SSL inspection. During the next six months, multiple web applications that will be separated out with subdomains will be deployed. Which of the following will allow the inspection of the data without multiple certificate deployments?
#24. A security engineer thinks the development team has been hard-coding sensitive environment variables in its code. Which of the following would BEST secure the company's CI/CD pipeline?
https://aws.amazon.com/secrets-manager/
AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT
resources. The service enables you to easily rotate, manage, and retrieve database credentials, API keys,
and other secrets throughout their lifecycle. Users and applications retrieve secrets with a call to Secrets
Manager APIs, eliminating the need to hardcode sensitive information in plain text
#25. A company's employees are not permitted to access company systems while traveling internationally. The company email system is configured to block logins based on geographic location, but some employees report their mobile phones continue to sync email while traveling . Which of the following is the MOST likely explanation? (Select TWO.)
Select all that apply:
#26. All staff at a company have started working remotely due to a global pandemic. To transition to remote work, the company has migrated to SaaS collaboration tools. The human resources department wants to use these tools to process sensitive information but is concerned the data could be: (see exhibit) What would mitigate the department's concerns?
Not VDI as we are using SaaS solutions.
DLP stops data exfiltration, Watermarking prevents print violations, proxy offers a layer of security, MFA stops admins gaining un-authorised access
#27. A Web application server was recently upgraded to TLS 1.3, now users are unable to connect their clients to the server. Attempts to reproduce the error are confirmed, and clients are reporting the following: ERR_SSL_VERSION_OR_CIPHER_MISMATCH What is MOST likely the root cause?
RC4 is deprecated – it is a weak symmetric cipher. All the other choices offer strong security
#28. Security Professionals receive a report about possible APT activity in the network. Which of the following threat management frameworks should a threat hunting team implement?
MITRE ATT&CK is a documented collection of information about the malicious behaviours advanced persistent threat (APT) groups have used at various stages in real-world cyberattacks
#29. A security analyst detected a malicious PowerShell attack on a single server. The malware used the InvokeExpression function to execute an external malicious script. The security analyst scanned the disk with an antivirus application and did not find any IOCs. The security analyst now needs to deploy a protection solution against this type of malware. Which of the following BEST describes the type of malware the solution should protect against?
#30. A CIO is considering migrating all company data to the cloud to save costs on expensive internal storage. What is a security concern that will MOST likely need to be addressed during migration?
Results
