CompTIA CySA+ Certification Exam Part 3 (61-71)

Because some clients have reported unauthorized activity on their accounts, a security analyst is reviewing network packet captures from the company's API server. A portion of a capture file is shownbelow: POST Section:(none) Explanation An organization is moving its infrastructureto the cloud in aneffortto meetthe budget and reduce staffing requirements. The organization has three environments: development, testing, and production.Theseenvironmentshaveinterdependencies butmustremain relatively segmented. Which ofthefollowingmethodswouldBEST securethecompany'sinfrastructure andbethesimplest tomanageandmaintain? A. Create three separate cloud accounts for each environment. Configure account peering and securityrules toallowaccesstoandfromeachenvironment. B.Create onecloudaccountwith oneVPC forall environments.Purchaseavirtual firewallandcreate granularsecurityrules. D.Createthree separatecloud accounts foreachenvironment anda single coreaccountfor network services. Routeall trafficthroughthe coreaccount. Apharmaceutical company'smarketing team wantsto sendoutnotifications aboutnew productsto alertusers of recalls andnewly discoveredadverse drug reactions. Theteam plansto usethe names andmailing addresses thatusershaveprovided. Whichofthefollowing dataprivacystandardsdoesthisviolate? B.Sovereignty C. Dataminimization D.Retention Question:69 SIMULATION Youareacybersecurityanalysttaskedwithinterpreting scandatafromCompanyA's servers.You must verifytherequirementsarebeingmetforalloftheservers andrecommendchangesifyoufind theyarenot. Thecompany'shardening guidelinesindicatethefollowing: • TLS1.2istheonlyversionofTLSrunning. • Apache2.4.18orgreatershould beused. • Only defaultportsshouldbe used. INSTRUCTIONS Using the supplied data, record the status of compliance with the company's guidelines for each server. Thequestioncontainstwoparts:makesureyoucompletePart1andPart2.Makerecommendations forissues based ONLYon thehardeningguidelines provided. Answer:See explanationbelow. Explanation: Part1Answer: Checkonthefollowing: AppServ1is only usingTLS.1.2 AppServ4is only usingTLS.1.2 AppServ1is usingApache2.4.18orgreater AppServ3is usingApache2.4.18orgreater AppServ4is usingApache2.4.18orgreater Part2answer: Recommendation: Recommendationisto disable TLSv1.1on AppServ2 and AppServ3. AlsoupgradeAppServ2Apache toversion 2.4.48from itscurrentversion of2.3.48 Question:70 Acybersecurityanalystiscurrently checking a newly deployedserverthathasanaccesscontrol list applied.Whenconductingthescan, theanalystreceivedthefollowingcodesnippetofresults: Whichofthefollowingdescribestheoutputofthisscan? B. The analysthas discovereda True Positive, and thestatus code is correctproviding a file not found errormessage. C. The analysthas discovereda True Positive, andthe statuscode isincorrectproviding a forbidden message. D. The analyst has discovered a False Positive, and the status code is incorrect providing a server errormessage. Explanation: Asystem’sauthority tooperate(ATO)is setto expirein fourdays. Because ofotheractivities and limited staffing, the organization has neglected to start reauthentication activities until now. The cybersecurity groupjustperformeda vulnerabilityscanwiththepartial setof resultsshownbelow: Basedonthescenarioandtheoutputfromthevulnerabilityscan,whichofthefollowingshouldthe securityteamdowiththisfinding? B.Accept this risk fornow because thisis a “high”severity, buttesting will requiremore than the fourdaysavailable, andthesystemATOneedstobecompeted. C. Ignoreit.This isfalse positive,andtheorganizationneedstofocusitseffortsonotherfindings. D.EnsureHTTPvalidationisenabledbyrebooting theserver.