Warriors 151-180

NO.151 Which of the following is a security best practice that ensures the integrity of aggregated log files within a SIEM?

• (A). Set up hashing on the source log file servers that complies with local regulatory requirements,

• (B). Back up the aggregated log files at least two times a day or as stated by local regulatory requirements.

• (C). Write protect the aggregated log files and move them to an isolated server with limited access.

• (D). Back up the source log files and archive them for at least six years or in accordance with local regulatory requirements.

NO.152 A company recently experienced an inside attack using a corporate machine that resulted in data compromise. Analysis indicated an unauthorized change to the software circumvented technological protection measures, The analyst was tasked with determining the best method to ensure the integrity of the systems remains intact and local and remote boot attestation can take place. Which of the following would provide the BEST solution?

• (A). HIPS

• (B). Flm

• (C). TPM

• (D). DLP

Answer explanation

https://learn.microsoft.com/en-us/azure/security/fundamentals/measured-boot-host-attestation

NO.153 A SOC operator is receiving continuous alerts from multiple Linux systems indicating that unsuccessful SSH attempts to a functional user ID have been attempted on each one of them in a short period of time. Which of the following BEST explains this behavior?

• (A). Rainbow table attack

• (B). Password spraying

• (C). Logic bomb

• (D). Malware bot

Answer explanation

Password Spraying is a variant of what is known as a brute force attack. In a traditional brute force attack, the perpetrator attempts to gain unauthorized access to a single account by guessing the password "repeatedly" in a very short period of time.

NO.154 A systems analyst is responsible for generating a new digital forensics chain-of-custody form. Which of the following should the analyst include in this documentation? (Select TWO).

• (A). The order of volatility

• (B). A CRC32 checksum

• (C). The provenance of the artifacts

• (E). The date timer

• (D). The vendor's name(F). A warning banne

NO.155 Which of the following can work as an authentication method and as an alerting mechanism for unauthorized access attempts?

• (A). Smart card

• (B). push notifications

• (C). Attestation service

• (D). HMAC-based, one-time password

NO.156 A company is receiving emails with links to phishing sites that look very similar to the company's own website address and content. Which of the following is the BEST way for the company to mitigate this attack?

• (A). Create a honeynet to trap attackers who access the VPN with credentials obtained by phishing.

• (B). Generate a list of domains similar to the company's own and implement a DNS sinkhole for each.

• (C). Disable POP and IMAP on all Internet-facing email servers and implement SMTPS.

• (D). Use an automated tool to flood the phishing websites with fake usernames and passwords.

NO.157 Which of the following is a risk that is specifically associated with hosting applications in the public cloud?

• (A). Unsecured root accounts

• (B). Zero-day

• (C). Shared tenancy

• (D). Insider threat

NO.158 Which of the following is an effective tool to stop or prevent the exfiltration of data from a network?

• (A). DLP

• (B). NIDS

• (C). TPM

• (D). FDE

Answer explanation

Data loss prevention (DLP) makes sure that users do not send sensitive or critical information outside the corporate network

NO.159 During a recent security incident at a multinational corporation a security analyst found the following logs for an account called user:.......Which Of the following account policies would BEST prevent attackers from logging in as user?

• (A). Impossible travel time

• (B). Geofencing

• (C). Time-based logins

• (D). Geolocation

NO.160 Which of the following secure coding techniques makes compromised code more difficult for hackers to use?

• (A). Obfuscation

• (B). Normalization

• (C). Execution

• (D). Reuse

Answer explanation

In software development, obfuscation is the act of creating source or machine code that is difficult for humans or computers to understand. Like obfuscation in natural language, it may use needlessly roundabout expressions to compose statements. Programmers may deliberately obfuscate code to conceal its purpose (security through obscurity) or its logic or implicit values embedded in it, primarily, in order to prevent tampering, deter reverse engineering, or even to create a puzzle or recreational challenge for someone reading the source code. This can be done manually or by using an automated tool, the latter being the preferred technique in industry.