Question 1

A team of security analysts has been alerted to potential malware activity. The initial examination indicates one of the affected workstations is beaconing on TCP port 80 to five IP addresses and attempting to spread across the network over port 445. Which of the following should be the team's NEXT step during the detection phase of this response process?

Accepted Answer

A)  Escalate the incident to management, who will then engage the network infrastructure team to keep them informed. 
B)  Depending on system criticality, remove each affected device from the network by disabling wired and wireless connections. 
C)  Engage the engineering team to block SMB traffic internally and outbound HTTP traffic to the five IP addresses. 
D)  Identify potentially affected systems by creating a correlation search in the SIEM based on the network traffic.

Question 2

A Chief Security Officer (CSO) is working on the communication requirements for an organization's incident response plan. In addition to technical response activities, which of the following is the main reason why communication must be addressed in an effective incident response program?

Accepted Answer

A)  Public relations must receive information promptly in order to notify the community. 
B)  Improper communications can create unnecessary complexity and delay response actions. 
C)  Organizational personnel must only interact with trusted members of the law enforcement community. 
D)  Senior leadership should act as the only voice for the incident response team when working with forensics teams.

Question 3

A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geographic zones, all of which were initiated through the web-based mail server. The logs indicate all domain accounts experienced two login attempts during the same time frame. Which of the following is the MOST likely cause of this issue?

Accepted Answer

A)  A password-spraying attack was performed against the organization. 
B)  A DDoS attack was performed against the organization. 
C)  This was normal shift work activity; the SIEM's AI is learning. 
D)  A credentialed external vulnerability scan was performed.

Question 4

For machine learning to be applied effectively toward security analysis automation, it requires __________.

Accepted Answer

A)  relevant training data. 
B)  a threat feed API. 
C)  a multicore, multiprocessor system. 
D)  anomalous traffic signatures.

Question 5

Which of the following MOST accurately describes an HSM?

Accepted Answer

A)  An HSM is a low-cost solution for encryption 
B)  An HSM can be networked based or a removable USB 
C)  An HSM is slower at encrypting than software 
D)  An HSM is explicitly used for MFA

Question 6

A large amount of confidential data was leaked during a recent security breach. As part of a forensic investigation, the security team needs to identify the various types of traffic that were captured between two compromised devices. Which of the following should be used to identify the traffic?

Accepted Answer

A)  Carving 
B)  Disk imaging 
C)  Packet analysis 
D)  Memory dump 
E)  Hashing

Question 7

While analyzing logs from a WAF, a cybersecurity analyst finds the following: "GET /form.php?id=463225%2b%2575%256e%2569%256f%256e%2b%2573%2574%2box3133333731,1223,1224&name=&state=IL" Which of the following BEST describes what the analyst has found?

Accepted Answer

A)  This is an encrypted GET HTTP request 
B)  A packet is being used to bypass the WAF 
C)  This is an encrypted packet 
D)  This is an encoded WAF bypass

Question 8

Which of the following software assessment methods would be BEST for gathering data related to an application's availability during peak times?

Accepted Answer

A)  Security regression testing 
B)  Stress testing 
C)  Static analysis testing 
D)  Dynamic analysis testing 
E)  User acceptance testing

Question 9

An analyst is searching a log for potential credit card leaks. The log stores all data encoded in hexadecimal. Which of the following commands will allow the security analyst to confirm the incident?

Accepted Answer

A)  cat log |xxd -r -p | egrep -v '[0-9]{16}' 
B)  egrep '(3[0-9]){16}' log 
C)  cat log |xxd -r -p | egrep '[0-9]{16}' 
D)  egrep '[0-9]{16}' log |xxd

Question 10

A compliance officer of a large organization has reviewed the firm's vendor management program but has discovered there are no controls defined to evaluate third-party risk or hardware source authenticity. The compliance officer wants to gain some level of assurance on a recurring basis regarding the implementation of controls by third parties. Which of the following would BEST satisfy the objectives defined by the compliance officer? (Choose two.)

Accepted Answer

A)  Executing vendor compliance assessments against the organization's security controls 
B)  Executing NDAs prior to sharing critical data with third parties 
C)  Soliciting third-party audit reports on an annual basis 
D)  Maintaining and reviewing the organizational risk assessment on a quarterly basis 
E)  Completing a business impact assessment for all critical service providers
F) Utilizing DLP capabilities at both the endpoint and perimeter levels

Question 11

A large organization wants to move account registration services to the cloud to benefit from faster processing and elasticity. Which of the following should be done FIRST to determine the potential risk to the organization?

Accepted Answer

A)  Establish a recovery time objective and a recovery point objective for the systems being moved 
B)  Calculate the resource requirements for moving the systems to the cloud 
C)  Determine recovery priorities for the assets being moved to the cloud-based systems 
D)  Identify the business processes that will be migrated and the criticality of each one 
E)  Perform an inventory of the servers that will be moving and assign priority to each one

Question 12

As part of a review of incident response plans, which of the following is MOST important for an organization to understand when establishing the breach notification period?

Accepted Answer

A)  Organizational policies 
B)  Vendor requirements and contracts 
C)  Service-level agreements 
D)  Legal requirements

Question 13

An analyst is performing penetration testing and vulnerability assessment activities against a new vehicle automation platform. Which of the following is MOST likely an attack vector that is being utilized as part of the testing and assessment?

Accepted Answer

A)  FaaS 
B)  RTOS 
C)  SoC 
D)  GPS 
E)  CAN bus

Question 14

A security analyst recently discovered two unauthorized hosts on the campus's wireless network segment from a man-in-the-middle attack. The security analyst also verified that privileges were not escalated, and the two devices did not gain access to other network devices. Which of the following would BEST mitigate and improve the security posture of the wireless network for this type of attack?

Accepted Answer

A)  Enable MAC filtering on the wireless router and suggest a stronger encryption for the wireless network 
B)  Change the SSID, strengthen the passcode, and implement MAC filtering on the wireless router 
C)  Enable MAC filtering on the wireless router and create a whitelist that allows devices on the network 
D)  Conduct a wireless survey to determine if the wireless strength needs to be reduced

Question 15

Which of the following policies would state an employee should not disable security safeguards, such as host firewalls and antivirus, on company systems?

Accepted Answer

A)  Code of conduct policy 
B)  Account management policy 
C)  Password policy 
D)  Acceptable use policy

Question 16

A security analyst received a series of antivirus alerts from a workstation segment, and users reported ransomware messages. During lessons-learned activities, the analyst determines the antivirus was able to alert to abnormal behavior but did not stop this newest variant of ransomware. Which of the following actions should be taken to BEST mitigate the effects of this type of threat in the future?

Accepted Answer

A)  Enabling sandboxing technology 
B)  Purchasing cyber insurance 
C)  Enabling application blacklisting 
D)  Installing a firewall between the workstations and Internet

Question 17

A financial institution's business unit plans to deploy a new technology in a manner that violates existing information security standards. Which of the following actions should the Chief Information Security Officer (CISO) take to manage any type of violation?

Accepted Answer

A)  Enforce the existing security standards and controls 
B)  Perform a risk analysis and qualify the risk with legal 
C)  Perform research and propose a better technology 
D)  Enforce the standard permits

Question 18

After a breach involving the exfiltration of a large amount of sensitive data, a security analyst is reviewing the following firewall logs to determine how the breach occurred:  Which of the following IP addresses does the analyst need to investigate further?

Accepted Answer

A)  192.168.1.1 
B)  192.168.1.10 
C)  192.168.1.12 
D)  192.168.1.193

Question 19

A company's marketing emails are either being found in a spam folder or not being delivered at all. The security analyst investigates the issue and discovers the emails in question are being sent on behalf of the company by a third party, mail.marketing.com. Below is the existing SPF record: v=spf1 a mx -all Which of the following updates to the SPF record will work BEST to prevent the emails from being marked as spam or blocked?

Accepted Answer

A)  v=spf1 a mx redirect:mail.marketing.com ?all 
B)  v=spf1 a mx include:mail.marketing.com -all 
C)  v=spf1 a mx +all 
D)  v=spf1 a mx include:mail.marketing.com ~all

Question 20

An information security analyst discovered a virtual machine server was compromised by an attacker. Which of the following should be the FIRST step to confirm and respond to the incident?

Accepted Answer

A)  Pause the virtual machine, 
B)  Shut down the virtual machine. 
C)  Take a snapshot of the virtual machine. 
D)  Remove the NIC from the virtual machine.

Exam 5: CompTIA Cloud Essentials+