532 BNS6 PT8

NO.358 Which of the following must be in place before implementing a BCP?

• (A). SLA

• (B). AUP

• (C). NDA

• (D). BIA

NO.359 A500 is implementing an insider threat detection program, The primary concern is that

users may be accessing confidential data without authorization. Which of the fallowing should be

deployed to detect a potential insider threat?

• (A). A honeyfile

• (B). A DMZ

• (C). ULF

• (D). File integrity monitoring

NO.360 A startup company is using multiple SaaS and IaaS platforms to stand up a corporate

infrastructure and build out a customer-facing web application. Which of the following solutions

would be BEST to provide security, manageability, and visibility into the platforms?

• (A). SIEM

• (B). DLP

• (C). CASB

• (D). SWG

NO.361 A security analyst is investigating multiple hosts that are communicating to external IP

addresses during the hours of 2:00 a.m - 4:00 am. The malware has evaded detection by traditional

antivirus software. Which of the following types of malware is MOST likely infecting the hosts?

• (A). A RAT

• (B). Ransomware

• (C). Logic bomb

• (D). A worm

NO.362 A public relations team will be taking a group of guest on a tour through the facility of a

large e-commerce company. The day before the tour, the company sends out an email to employees

to ensure all whiteboars are cleaned and all desks are cleared. The company is MOST likely trying to

protect against.

• (A). Loss of proprietary information

• (B). Damage to the company's reputation

• (C). Social engineering

• (D). Credential exposure

NO.363 A desktop support technician recently installed a new document-scanning software program

on a computer However, when the end user tried to launch the program, it did not respond. Which of

the following is MOST likely the cause?

• (A). A new firewall rule is needed to access the application.

• (B). The system was quarantined for missing software updates

• (C). The software was not added to the application whitelist.

• (D). The system was isolated from the network due to infected software.

NO.364 Users reported several suspicious activities within the last two weeks that resulted in

several unauthorized transactions. Upon investigation, the security analyst found the following:

* Multiple reports of breached credentials within that time period

* Traffic being redirected in certain parts of the network

* Fraudulent emails being sent by various internal users without their consent Which of the following

types of attacks was MOST likely used?

• (A). Replay attack

• (B). Race condition

• (C). Cross site scripting

• (D). Request forgeries

NO.365 An organization recently acquired an ISO 27001 certification. Which of the following would

MOST likely be considered a benefit of this certification?

• (A). It allows for the sharing of digital forensics data across organizations

• (B). It provides insurance in case of a data breach

• (C). It provides complimentary training and certification resources to IT security staff.

• (D). It certifies the organization can work with foreign entities that require a security clearance

• (E). It assures customers that the organization meets security standards

NO.366 A security analyst is configuring a large number of new company-issued laptops. The analyst

received the following requirements:

* The devices will be used internationally by staff who travel extensively.

* Occasional personal use is acceptable due to the travel requirements.

* Users must be able to install and configure sanctioned programs and productivity suites.

* The devices must be encrypted

* The devices must be capable of operating in low-bandwidth environments.

Which of the following would provide the GREATEST benefit to the security posture of the devices?

• (A). Configuring an always-on VPN

• (B). Implementing application whitelisting

• (C). Requiring web traffic to pass through the on-premises content filter

• (D). Setting the antivirus DAT update schedule to weekly

NO.367 A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network

protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom.

Which of the following would BEST prevent this attack from reoccurring?

• (A). Configure the perimeter firewall to deny inbound external connections to SMB ports.

• (B). Ensure endpoint detection and response systems are alerting on suspicious SMB connections.

• (C). Deny unauthenticated users access to shared network folders.

• (D). Verify computers are set to install monthly operating system, updates automatically.