CompTIA CySA+ Certification Exam Part 4 (72-97)

Anorganizationsuspects ithashad a breach, and itistrying todetermine the potential impact.The organizationknowsthefollowing: ThesourceofthebreachislinkedtoanIP locatedinaforeigncountry. Thebreachis isolatedtothe researchanddevelopmentservers. Thehashvaluesofthedatabeforeandafterthebreachareunchanged. Theaffectedserverswereregularly patched,and arecentscanshowedno vulnerabilities. Whichofthe following conclusionscan be drawnwithrespecttothethreatandimpact? (Choose two.) A. Theconfidentialityofthedataisunaffected. C. ThesourceIP ofthe threathas been spoofed. E. Thethreatis aninsider. Explanation: Asystemisexperiencing noticeably slowresponsetimes,andusers arebeing lockedoutfrequently. An analyst asked for the system security plan and found the system comprises two servers: an application server in the DMZ and a database server inside the trusted domain. Which of the followingshouldbe performed NEXTtoinvestigatetheavailabilityissue? A.Reviewthefirewalllogs. C.Performfuzzing. D.Install aWAFinfrontoftheapplicationserver. Explanation: Ann, a user, reports to the security team that her browser began redirecting her to random sites whileusing her Windows laptop. Annfurtherreportsthat the OSshows theC:drive is out of space despitehaving plentyofspace recently. Ann claimsshenotdownloaded anything. Thesecurity team obtains thelaptopandbeginstoinvestigate,notingthe following: Fileaccessauditing isturnedoff. Whenclearingupdisk spacetomakethelaptopfunctional,filesthatappeartobe cachedwebpages areimmediatelycreatedinatemporarydirectory,filling uptheavailabledrivespace. Allprocessesrunningappeartobelegitimateprocessesforthisuserandmachine. Networktrafficspikeswhenthespaceisclearedonthelaptop. Nobrowserisopen. Which of the following initial actions and tools would provide the BEST approach to determining whatishappening? A. Deletethetemporaryfiles,runanNmapscan,andutilizeBurpSuite. C. Performahardpowerdown ofthelaptop,takeaddimage, andanalyzewithFTK. D.Review logins tothelaptop,searchWindowsEventViewer,and review Wiresharkcaptures. Explanation: Asecurity architectis reviewing the options forperforming input validation on incoming web form submissions. Which of the following should the architect as the MOST secure and manageable option? A.Client-sidewhitelisting C.Server-sideblacklisting D.Client-sideblacklisting Explanation: AsecurityadministratorneedstocreateanIDS ruletoalert onFTPloginattemptsbyroot.Whichof thefollowingrulesistheBESTsolution? A.OptionA C. OptionC D.OptionD Explanation: Thecomputerincidentresponse team atamultinational companyhas determinedthata breach of sensitivedatahasoccurredin which athreatactorhascompromised theorganization’semailsystem. Per theincidentresponseprocedures,thisbreachrequiresnotifyingtheboardimmediately. Which ofthefollowingwouldbetheBESTmethodofcommunication? A. Postofthecompanyblog B.Corporate-hostedencryptedemail D.Summarysentbycertifiedmail E. Externallyhostedinstantmessage Explanation: During an investigation, an incident responder intends to recover multiple pieces of digital media. Before removing the media, the responder should initiate: A.malwarescans. B.securecommunications. D.decryptiontools. Explanation: A malicious hacker wants to gather guest credentials on a hotel 802.11 network. Which of the followingtools isthemalicioushackergoingtouse togainaccesstoinformationfoundonthehotel network? A.Nikto C.Nessus D.tcpdump Explanation: Asecurityanalystreceivedanemail withthefollowing key: Xj3XJ3LLc Asecondsecurityanalystreceivedanemailwithfollowing key: 3XJ3xjcLLC Thesecuritymanagerhas informedthetwoanalyststhattheemailtheyreceivedis a key thatallows accesstothe company’s financial segmentformaintenance.Thisis anexample of: B.privatekeyencryption C. separationofduties D.publickeyencryption E. two-factorauthentication Explanation: Which of the following is the BEST way to share incident-related artifacts to provide nonrepudiation? B.EncryptedUSBdrives C. Cloudcontainers D.Networkfolders Explanation: Asecurity analysthas asample ofmalicious softwareand needsto know whatthe sample does?The analyst runs the sample in a carefully controlled and monitored virtual machine to observe the softwarebehavior. Whichofthefollowingmalwareanalysisapproachesisthis? A.Whiteboxtesting B.Fuzzing D.Staticcode analysis Ananalystisreviewing a listof vulnerabilities, whichwerereported from a recentvulnerability scan ofaLinuxserver. WhichofthefollowingisMOSTlikelytobeafalsepositive? A. OpenSSH/OpenSSLPackageRandomNumberGeneratorWeakness B.ApacheHTTPServerByteRange DoS C. GDI+RemoteCode ExecutionVulnerability(MS08-052) D.HTTP TRACE/ TRACKMethodsAllowed(002-1208) Explanation: Asecurity analyst,who isworking foracompanythatutilizesLinuxservers,receives the following resultsfromavulnerabilityscan: Whichofthefollowing isMOSTlikely afalse positive? A. ICMPtimestamprequestremote datedisclosure B.Windows SMBserviceenumerationvia\srvsvc C.AnonymousFTPenabled Explanation: Whichofthefollowingshouldbefoundwithinanorganization'sacceptableusepolicy? A. Passwordsmustbeeightcharactersinlengthandcontainatleastonespecialcharacter. B. Customer data must be handled properly, stored on company servers, and encrypted when possible C. Administratoraccountsmustbeauditedmonthly, andinactiveaccountsshouldberemoved. Explanation: Ananalystidentifiesmultiple instancesofnode-to-nodecommunication betweenseveralendpoints within the 10.200.2.0/24 network and a user machine at the IP address 10.200.2.5. This user machineatthe IP address10.200.2.5is alsoidentifiedas initiating outbound communication during atypical business hourswithseveralIPaddressesthathaverecently appearedon threatfeeds. Whichofthefollowing canbeinferredfromthisactivity? A. 10.200.2.0/24isinfectedwithransomware. B.10.200.2.0/24isnotroutable addressspace. C. 10.200.2.5isa rogueendpoint. Explanation: A system administrator is doing network reconnaissance of a company’s external network to determinethe vulnerability of variousservicesthat arerunning. Sendingsomesample trafficto the externalhost,theadministratorobtainsthefollowingpacketcapture: Based ontheoutput,whichofthefollowingservicesshould befurther testedforvulnerabilities? A.SSH B.HTTP D.HTTPS Explanation: Ransomwareis identifiedon acompany'snetworkthat affectsbothWindows andMAC hosts.The commandand controlchannel forencryption forthis variantuses TCPportsfrom11000 to 65000. Thechannel goestogood1. Iholdbadkeys.com,whichresolvestoIPaddress72.172.16.2. Which of the following is the MOST effective way to prevent any newly infected systems from actually encrypting the data on connected network drives while causing the least disruption to normalInternettraffic? B.Blockalloutbound TCPconnectionstoIP hostaddress172.172.16.2atthebordergateway. C. Blockall outboundtrafficonTCP ports11000to65000atthebordergateway. D. Block all outbound traffic on TCP ports 11000 to 65000 to IP host address 172.172.16.2 at the bordergateway. Explanation: Ahuman resourcesemployee sends outa massemail to allemployees thatcontains their personnel records.Asecurityanalyst iscalledintoaddresstheconcernofthehumanresourcesdirector onhow topreventthis fromhappening in thefuture. WhichofthefollowingwouldbetheBESTsolutiontorecommendtothedirector? B.Enforceencryptiononall emailssentwithinthecompany.Createa PII programandpolicyon how tohandle data.Trainallhumanresourcesemployees. C. Train all employees. Encrypt data sent on the company network. Bring in privacy personnel to presentaplanonhow PIIshouldbe handled. D.Install specific equipmenttocreatea humanresources policythat protectsPII data.Train company employees on how to handle PII data. Outsource all PII to another company. Send the human resourcesdirectortotrainingforPII handling. Explanation: Riskmanagementwants ITto implementa solution thatwill permitananalyst tointercept, execute, andanalyzepotentiallymaliciousfilesthataredownloaded fromtheInternet. Whichofthefollowing wouldBESTprovide this solution? A.Filefingerprinting B.Decompositionofmalware C.Riskevaluation Joe, a penetration tester, used a professional directory to identify a network administrator and ID administrator for aclient’scompany. Joethen emailedthenetworkadministrator,identifyinghimself astheID administrator,andaskedforacurrentpasswordaspart ofa securityexercise. Whichof the followingtechniqueswereusedinthisscenario? A. EnumerationandOSfingerprinting B.Email harvesting andhostscanning D.Networkandhostscanning Explanation: Awebdeveloper wants tocreate a new webpartwithin the companywebsite that aggregatessales from individual team sites. A cybersecurity analyst wants to ensure security measurements are implementedduringthis process. Whichofthe followingremediationactions shouldtheanalysttake toimplementa vulnerability managementprocess? A.Personneltraining B.Vulnerabilityscan D.Sandboxing Explanation: Asecurityteam isimplementing a new vulnerabilitymanagementprogramin anenvironmentthat has a historically poor security posture. The team is aware of issues patch management in the environmentandexpectsalarge numberof findings.Whichofthe following wouldbethe MOST efficientwaytoincreasethesecuritypostureof theorganizationintheshortestamountoftime? A. Create anSLA statingthat remediationactionsmustoccurwithin 30 daysof discoveryforall levels ofvulnerabilities. C. Create classificationcriteria fordataresiding on differentserversand provideremediation only for servershousingsensitivedata. D.Implementa change controlpolicy thatallows the security team toquicklydeploy patchesin the productionenvironmenttoreducethe risk ofanyvulnerabilitiesfound. Explanation: Which ofthefollowing istheuseoftoolstosimulatetheabilityforanattackertogainaccesstoa specifiednetwork? A.Reverseengineering B.Fuzzing D.Networkmapping Acompanyjustchoseaglobal softwarecompanybasedin Europetoimplementa newsupply chain managementsolution. Whichofthefollowing wouldbe theMAIN concernofthe company? B. Packetinjection C. Lossofintellectualproperty D.Internationallaborlaws Question:96 WelcometotheEnterpriseHelpDeskSystem.Pleaseworktheticketescalatedtoyouinthedesk ticketqueue. INSTRUCTIONS Clickon me tickettosee theticketdetails Additionalcontentisavailableontabswithinthe ticket First,select theappropriateissuefromthedrop-down menu.Then,selectthe MOSTlikelyroot cause fromseconddrop-downmenu Ifat anytime youwould liketobringback the initial stateofthe simulation, please clickthe Reset All button Answer: Anemployeein the billing departmentaccidentally senta spreadsheetcontaining paymentcard data toarecipientoutsidetheorganizationTheemployeeintendedtosendthespreadsheettoaninternal staffmemberwith asimilar name andwas unawareofthemistakeuntil therecipientrepliedtothe message In addition to retraining the employee, which of the following would prevent this from happeninginthefuture? A. Implementoutgoing filterrulestoquarantinemessagesthatcontaincarddata C. Remove allexternalrecipientsfromtheemployee'saddressbook D.Settheoutgoing mailfiltertostripspreadsheetattachmentsfromall messages.