CYSA + (251-300)

Which of the following is the order of priority for risk mitigation from highest to lowest?

(ExamTopic'e gore guncellendi)

• A. A, B, C, D

• B. A, D, B, C

• C. B, C, A, D

• D. C, B, D, A

• E. D, A, C, B

NO.252 A security analyst for a large financial institution is creating a threat model for a specific threat actor that is likely targeting an organization's financial assets. Which of the following is the BEST example of the level of sophistication this threat actor is using?

• A. Social media accounts attributed to the threat actor

• B. Custom malware attributed to the threat actor from prior attacks

• C. Email addresses and phone numbers tied to the threat actor

• D. Network assets used in previous attacks attributed to the threat actor

• E. IP addresses used by the threat actor for command and control

NO.253 A security analyst is investigating malicious traffic from an internal system that attempted to download proxy avoidance software as identified from the firewall logs but the destination IP is blocked and not captured. Which of the following should the analyst do?

• A. Shut down the computer

• B. Capture live data using Wireshark

• C. Take a snapshot

• D. Determine if DNS logging is enabled.

• E. Review the network logs.

NO.254 An organization has the following policies: Services must run on standard ports. Unneeded services must be disabled. The organization has the following servers: 192.168.10.1 - web server 192.168.10.2 - database server A security analyst runs a scan on the servers and sees the following output:

• A. Disable HTTPS on 192.168.10.1

• B. Disable IIS on 192.168.10.1

• C. Disable DNS on 192.168.10.2

• D. Disable MSSQL on 192.168.10.2

• E. Disable SSH on both servers

NO.255 A security analyst has a sample of malicious software and needs to know what the sample does? The analyst runs the sample in a carefully controlled and monitored virtual machine to observe the software behavior. Which of the following malware analysis approaches is this?

• A. White box testing

• B. Fuzzing

• C. Sandboxing

• D. Static code analysis

NO.256 A Chief Executive Officer (CEO) is concerned about the company's intellectual property being leaked to competitors. The security team performed an extensive review but did not find any indication of an outside breach. The data sets are currently encrypted using the Triple Data Encryption Algorithm. Which of the following courses of action is appropriate?

• A. Limit all access to the sensitive data based on geographic access requirements with strict rolebased access controls

• B. Enable data masking and reencrypt the data sets using AES-256.

• C. Ensure the data is correctly classified and labeled, and that DLP rules are appropriate to prevent disclosure.

• D. Use data tokenization on sensitive fields, reencrypt the data sets using AES-256, and then create an MD5 hash

NO.257 An information security analyst is working with a data owner to identify the appropriate controls to preserve the confidentiality of data within an enterprise environment One of the primary concerns is exfiltration of data by malicious insiders Which of the following controls is the MOST appropriate to mitigate risks?

• A. Data deduplication

• B. OS fingerprinting

• C. Digital watermarking

• D. Data loss prevention

NO.258 An organization is upgrading its network and all of its workstations. The project will occur in phases, with infrastructure upgrades each month and workstation installs every other week. The schedule should accommodate the enterprise-wide changes, while minimizing the impact to the network. Which of the following schedules BEST addresses these requirements?

• A. Monthly topology scans, biweekly host discovery scans, weekly vulnerability scans

• B. Monthly vulnerability scans, biweekly topology scans, daily host discovery scans

• C. Monthly host discovery scans; biweekly vulnerability scans, monthly topology scans

• D. Monthly topology scans, biweekly host discovery scans, monthly vulnerability scans

NO.259 A user reports a malware alert to the help desk A technician verifies the alert, determines the workstation is classified as a low-severity device, and uses network controls to block access The technician then assigns the ticket to a security analyst who will complete the eradication and recovery processes. Which of the following should the security analyst do NEXT?

• A. Document the procedures and walk through the incident training guide

• B. Sanitize the workstation and verify countermeasures are restored

• C. Reverse engineer the malware to determine its purpose and risk to the organization

• D. Isolate the workstation and issue a new computer to the user.

NO.260 A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verity that a user's data is not altered without the user's consent Which of the following would be an appropriate course of action?

• A. Use a DLP product to monitor the data sets for unauthorized edits and changes.

• B. Use encryption first and then hash the data at regular, defined times

• C. Automate the use of a hashing algorithm after verified users make changes to their data

• D. Replicate the data sets at regular intervals and continuously compare the copies for unauthorized changes.