Question 1

An analyst has been asked to provide feedback regarding the controls required by a revised regulatory framework. At this time, the analyst only needs to focus on the technical controls. Which of the following should the analyst provide an assessment of?
A) Tokenization of sensitive data
B) Establishment of data classifications
C) Reporting on data retention and purging activities
D) Formal identification of data ownership
E) Execution of NDAs

Accepted Answer

Tokenization of sensitive data is a technical control that involves replacing sensitive data with non-sensitive equivalents, which is relevant to the analyst's focus on technical controls.

Question 2

During an incident, a cybersecurity analyst found several entries in the web server logs that are related to an IP with a bad reputation. Which of the following would cause the analyst to further review the incident?
A) BadReputationIp - - [2019-04-12 10:43Z] "GET /etc/passwd" 403 1023
B) BadReputationIp - - [2019-04-12 10:43Z] "GET /index.html?src=../.ssh/id_rsa" 401 17044
C) BadReputationIp - - [2019-04-12 10:43Z] "GET /a.php?src=/etc/passwd" 403 11056
D) BadReputationIp - - [2019-04-12 10:43Z] "GET /a.php?src=../../.ssh/id_rsa" 200 15036
E) BadReputationIp - - [2019-04-12 10:43Z] "GET /favicon.ico?src=../usr/share/icons" 200 19064

Accepted Answer

The answer of During an incident, a cybersecurity analyst found...

Question 3

A developer wrote a script to make names and other PII data unidentifiable before loading a database export into the testing system. Which of the following describes the type of control that is being used?
A) Data encoding
B) Data masking
C) Data loss prevention
D) Data classification

Accepted Answer

Data masking is the process of hiding original data with modified content, which is what the developer is doing to make PII data unidentifiable.

Question 4

A security analyst discovered a specific series of IP addresses that are targeting an organization. None of the attacks have been successful. Which of the following should the security analyst perform NEXT?
A) Begin blocking all IP addresses within that subnet
B) Determine the attack vector and total attack surface
C) Begin a kill chain analysis to determine the impact
D) Conduct threat research on the IP addresses

Accepted Answer

Conducting threat research on the IP addresses will help the analyst understand the nature of the threat, the potential risk, and the appropriate response before taking further action.

Question 5

As part of a review of incident response plans, which of the following is MOST important for an organization to understand when establishing the breach notification period?
A) Organizational policies
B) Vendor requirements and contracts
C) Service-level agreements
D) Legal requirements

Accepted Answer

Legal requirements are the most important factor to consider when establishing the breach notification period, as they dictate the mandatory timeframes within which organizations must notify affected parties and authorities about a data breach.

Question 6

A cybersecurity analyst needs to rearchitect the network using a firewall and a VPN server to achieve the highest level of security. To BEST complete this task, the analyst should place the:
A) firewall behind the VPN server
B) VPN server parallel to the firewall
C) VPN server behind the firewall
D) VPN on the firewall

Accepted Answer

Placing the VPN server behind the firewall ensures that all incoming traffic is filtered and inspected by the firewall before reaching the VPN server, providing an additional layer of security.

Question 7

A security analyst is investigating a compromised Linux server. The analyst issues the ps command and receives the following output:  Which of the following commands should the administrator run NEXT to further analyze the compromised system?
A) strace /proc/1301
B) rpm -V openssh-server
C) /bin/ls -l /proc/1301/exe
D) kill -9 1301

Accepted Answer

The answer of A security analyst is investigating a compromised...

Question 8

A threat feed notes malicious actors have been infiltrating companies and exfiltrating data to a specific set of domains. Management at an organization wants to know if it is a victim. Which of the following should the security analyst recommend to identify this behavior without alerting any potential malicious actors?
A) Create an IPS rule to block these domains and trigger an alert within the SIEM tool when these domains are requested.
B) Add the domains to a DNS sinkhole and create an alert in the SIEM tool when the domains are queried
C) Look up the IP addresses for these domains and search firewall logs for any traffic being sent to those IPs over port 443
D) Query DNS logs with a SIEM tool for any hosts requesting the malicious domains and create alerts based on this information

Accepted Answer

Adding the domains to a DNS sinkhole and creating an alert in the SIEM tool when the domains are queried will allow the security analyst to identify if the organization is a victim without alerting any potential malicious actors.

Question 9

An analyst performs a routine scan of a host using Nmap and receives the following output:  Which of the following should the analyst investigate FIRST?
A) Port 21
B) Port 22
C) Port 23
D) Port 80

Accepted Answer

The answer of An analyst performs a routine scan of...

Question 10

Which of the following attacks can be prevented by using output encoding?
A) Server-side request forgery
B) Cross-site scripting
C) SQL injection
D) Command injection
E) Cross-site request forgery
F) Directory traversal

Accepted Answer

Output encoding is effective in preventing cross-site scripting (XSS) attacks by ensuring that any data sent to the browser is treated as data, not executable code.

Question 11

A security analyst recently discovered two unauthorized hosts on the campus's wireless network segment from a man-in-the-middle attack. The security analyst also verified that privileges were not escalated, and the two devices did not gain access to other network devices. Which of the following would BEST mitigate and improve the security posture of the wireless network for this type of attack?
A) Enable MAC filtering on the wireless router and suggest a stronger encryption for the wireless network
B) Change the SSID, strengthen the passcode, and implement MAC filtering on the wireless router
C) Enable MAC filtering on the wireless router and create a whitelist that allows devices on the network
D) Conduct a wireless survey to determine if the wireless strength needs to be reduced

Accepted Answer

Changing the SSID and strengthening the passcode can prevent unauthorized access, while implementing MAC filtering adds an additional layer of security by allowing only known devices to connect.

Question 12

Which of the following is the MOST important objective of a post-incident review?
A) Capture lessons learned and improve incident response processes
B) Develop a process for containment and continue improvement efforts
C) Identify new technologies and strategies to remediate
D) Identify a new management strategy

Accepted Answer

The primary objective of a post-incident review is to capture lessons learned from the incident to improve future incident response processes and prevent similar incidents from occurring.

Question 13

A security manager has asked an analyst to provide feedback on the results of a penetration test. After reviewing the results, the manager requests information regarding the possible exploitation of vulnerabilities. Which of the following information data points would be MOST useful for the analyst to provide to the security manager, who would then communicate the risk factors to senior management? (Choose two.)
A) Probability
B) Adversary capability
C) Attack vector
D) Impact
E) Classification
F) Indicators of compromise

Accepted Answer

Probability and impact are the most useful information data points for the analyst to provide to the security manager, who would then communicate the risk factors to senior management. Probability refers to the likelihood of a vulnerability being exploited, while impact refers to the potential consequences of a successful exploitation. These two factors are essential for understanding the overall risk posed by a vulnerability and for making decisions about how to mitigate that risk.

Question 14

While preparing for an audit of information security controls in the environment, an analyst outlines a framework control that has the following requirements: All sensitive data must be classified. All sensitive data must be purged on a quarterly basis. Certificates of disposal must remain on file for at least three years. This framework control is MOST likely classified as:
A) prescriptive
B) risk-based
C) preventive
D) corrective

Accepted Answer

The framework control is prescriptive because it specifies exact actions and requirements that must be followed, such as classifying data, purging it quarterly, and maintaining disposal certificates.

Question 15

A web-based front end for a business intelligence application uses pass-through authentication to authenticate users. The application then uses a service account to perform queries and look up data in a database. A security analyst discovers employees are accessing data sets they have not been authorized to use. Which of the following will fix the cause of the issue?
A) Change the security model to force the users to access the database as themselves
B) Parameterize queries to prevent unauthorized SQL queries against the database
C) Configure database security logging using syslog or a SIEM
D) Enforce unique session IDs so users do not get a reused session ID

Accepted Answer

The issue arises because the application uses a service account for database access, which does not enforce user-specific permissions. Changing the security model to have users access the database as themselves ensures that their individual permissions are applied, preventing unauthorized data access.

Question 16

As part of an organization's information security governance process, a Chief Information Security Officer (CISO) is working with the compliance officer to update policies to include statements related to new regulatory and legal requirements. Which of the following should be done to BEST ensure all employees are appropriately aware of changes to the policies?
A) Conduct a risk assessment based on the controls defined in the newly revised policies
B) Require all employees to attend updated security awareness training and sign an acknowledgement
C) Post the policies on the organization's intranet and provide copies of any revised policies to all active vendors
D) Distribute revised copies of policies to employees and obtain a signed acknowledgement from them

Accepted Answer

Requiring all employees to attend updated security awareness training and sign an acknowledgement ensures that they are not only informed about the changes but also understand them, which is crucial for compliance and effective implementation.

Question 17

A security analyst is reviewing the following log entries to identify anomalous activity:  Which of the following attack types is occurring?
A) Directory traversal
B) SQL injection
C) Buffer overflow
D) Cross-site scripting

Accepted Answer

The answer of A security analyst is reviewing the following...

Question 18

Clients are unable to access a company's API to obtain pricing data. An analyst discovers sources other than clients are scraping the API for data, which is causing the servers to exceed available resources. Which of the following would be BEST to protect the availability of the APIs?
A) IP whitelisting
B) Certificate-based authentication
C) Virtual private network
D) Web application firewall

Accepted Answer

The answer of Clients are unable to access a company's...

Question 19

A company wants to establish a threat-hunting team. Which of the following BEST describes the rationale for integrating intelligence into hunt operations?
A) It enables the team to prioritize the focus areas and tactics within the company's environment
B) It provides criticality analyses for key enterprise servers and services
C) It allows analysts to receive routine updates on newly discovered software vulnerabilities
D) It supports rapid response and recovery during and following an incident

Accepted Answer

Integrating intelligence into hunt operations helps the team prioritize focus areas and tactics by providing insights into potential threats and vulnerabilities specific to the company's environment, making the hunt more effective.

Question 20

A security analyst discovers accounts in sensitive SaaS-based systems are not being removed in a timely manner when an employee leaves the organization. To BEST resolve the issue, the organization should implement:
A) federated authentication
B) role-based access control
C) manual account reviews
D) multifactor authentication

Accepted Answer

Federated authentication allows for centralized management of user identities, which can automate the process of account removal when an employee leaves, ensuring timely deactivation across all connected systems.

Exam 5: CompTIA Cloud Essentials+

An analyst has been asked to provide feedback regarding the controls required by a revised regulatory framework. At this time, the analyst only needs to focus on the technical controls. Which of the following should the analyst provide an assessment of?

During an incident, a cybersecurity analyst found several entries in the web server logs that are related to an IP with a bad reputation. Which of the following would cause the analyst to further review the incident?

A developer wrote a script to make names and other PII data unidentifiable before loading a database export into the testing system. Which of the following describes the type of control that is being used?

A security analyst discovered a specific series of IP addresses that are targeting an organization. None of the attacks have been successful. Which of the following should the security analyst perform NEXT?

As part of a review of incident response plans, which of the following is MOST important for an organization to understand when establishing the breach notification period?

A cybersecurity analyst needs to rearchitect the network using a firewall and a VPN server to achieve the highest level of security. To BEST complete this task, the analyst should place the:

A security analyst is investigating a compromised Linux server. The analyst issues the ps command and receives the following output: Which of the following commands should the administrator run NEXT to further analyze the compromised system?

An analyst performs a routine scan of a host using Nmap and receives the following output: Which of the following should the analyst investigate FIRST?

Which of the following attacks can be prevented by using output encoding?

Which of the following is the MOST important objective of a post-incident review?

A security analyst is reviewing the following log entries to identify anomalous activity: Which of the following attack types is occurring?

Clients are unable to access a company's API to obtain pricing data. An analyst discovers sources other than clients are scraping the API for data, which is causing the servers to exceed available resources. Which of the following would be BEST to protect the availability of the APIs?

A company wants to establish a threat-hunting team. Which of the following BEST describes the rationale for integrating intelligence into hunt operations?

A security analyst discovers accounts in sensitive SaaS-based systems are not being removed in a timely manner when an employee leaves the organization. To BEST resolve the issue, the organization should implement: