assessment, Kevin needs to grab the basic architecture to identify the framework used. He grabbed the HTTP header banner using Netcat, which gives you the application name, software version, and web server information. What activity did he just perform?FingerprintingAuthenticationAuthorizationCode review148 Many of your corporate users are using mobile laptop computers to perform their work remotely. Security is concerned that confidential data residing on these laptops may be disclosed and leaked to the public. What methodology best helps prevent the loss of such data?DLPHIPSNIDSNIPS
149 Your CISO, Karen, is concerned that all employees can use personal USB storage devices on the company's computers. She is concerned about malware introduction to the corporate environment and that data loss is possible if this practice continues. She wants to manage who can use USB storage devices on the company's computers. Which of the following actions should be used to implement this constraint?Replacing all computers with those that do not have USB portsPlacing glue in the computers' USB portsCutting the computers' USB cablesConfiguring a Group Policy within Microsoft Active Directory to manage USB storage device use on those computers
150 Many organizations prepare for highly technical attacks and forget about the simple low-tech means of gathering information. Dumpster diving can be useful in gaining access to unauthorized information. Which of these is the easiest to implement for reducing your company's dumpster-diving risk?Data classification and printer restrictions of intellectual property.Purchase shredders for the copy rooms.Create policies and procedures for document shredding.Employ an intern to shred all printed documentation.
151 Your organization decided to move away from dedicated computers on the desktop and move to a virtual desktop environment. The desktop image resides on a server within a virtual machine and is accessed via a desktop client over the network. Which of the following is being described?VPNVDIVNCRDP
152 Using Microsoft Network Monitor, you have captured traffic on TCP port 3389. Your security policy states that port 3389 is not to be used. What client-server protocol is probably running over this port?SNMPRDPPuTTYFTP
153 Your organization is pressured by both the company board and employees to allow personal devices on the network. They asked for email and calendar items to be synced between the company ecosystem and their BYOD. Which of the following best balances security and usability?Allowing access for the management team only because they have a need for convenient accessNot allowing any access between a BYOD device and the corporate network, only cloud applicationsOnly allowing certain types of devices that can be centrally managedReviewing security policy and performing a risk evaluation focused on central management, including the remote wipe and encryption of sensitive data and training users on privacy
154 Nathan is tasked with writing the security viewpoint of a new program that his organization is starting. Which of the following techniques make this a repeatable process and can be used for creating the best security architecture?Data classification, CIA triad, minimum security required, and risk analysisHistorical documentation, continuous monitoring, and mitigation of high risksImplementation of proper controls, performance of qualitative analysis, and continuous monitoringRisk analysis; avoidance of critical risks, threats, and vulnerabilities; and the transference of medium risk
155 You deployed more than half of your enterprise into the cloud, but you still have concerns about data loss, unauthorized access, and encryption. What continues to be the vulnerability in cloud infrastructure that leads to the most breaches?MisconfigurationSIEMSaaSMachine learning
156 Your company generates documents intended for public viewing. While your company wants to make these document public, it stills wants to prove the documents originated from the company. How can these documents be marked in such a way that information about their origin is maintained while not distorting the visual contents of the documents?BlowfishSteganographic watermarkingDigital signaturesPKI
157 Charlie works for a publisher and has been tasked with protecting the electronic media they produce. This will help ensure they receive the revenue for the product they produce. What is Charlie going to implement?Single point-of-failureDigital rights managementSeparate of dutiesMandatory vacations
158 As a security analyst, Ben is searching for a method that can examine network traffic and filter its payload based on rules. What is this method called?Network flowDLPData flow enforcementDeep packet inspection
159 You are a security administrator reviewing network logs. You notice a UDP trend where traffic increased more than 30 percent in the past 48 hours. You use Wireshark to capture the packets and see the following: UDP 192.168.1.1:123->46.110.10.5:123. What attack scenario is most likely occurring?You are being attacked via the NTP client side and successfully exploited on 192.168.1.1.You are being attacked via the NTP server side and unsuccessfully exploited on 192.168.1.1.You are being attacked via the DNS client side and successfully exploited on 192.168.1.1.You are being attacked via the DNS server side and successfully exploited on 192.168.1.1.
160 René is working with upper management to classify data to be shared in his collaboration tool, which will create extra security controls limiting the likelihood of a data breach. What principle of information security is he trying to enforce?ConfidentialityIntegrityAccountabilityAvailability
161 A new objective for your department is to establish data provenance or historical data records. Moving forward, you must now document the data's source and all manipulations performed on it. Every data item will have detailed information about its origin and the ways it was influenced. Why is this crucial to the security of the data?Unauthorized changes in metadata can lead you to the wrong datasets.Authorized changes to the data warehouse can lead you to the wrong datasets.Traceable data sources make it difficult to find security breaches.Traceable data sources make it difficult to find fake data generation.
162 Your CTO believes in the adage “Security through obscurity.” Which of the following types of obfuscation makes a program obscure to other computers?PreventionSaturationControl flowData
163 Lynn uses a process that substitutes a sensitive data element with something that is not sensitive. She uses this process to map back to the sensitive data. What is this called?MaskingEncryptionTokenizationAuthorization
164 Which of the following storage techniques should you deploy if you want the option to selectively provide availability to some hosts and to restrict availability to others by using a masking process?NASSANiSCSILUN
165 Ashton's end users are using mobile devices to access confidential information on the corporate network. He needs to ensure that the information from all databases is kept secure as it is transmitted to these mobile devices. Encryption is a requirement. Of the following options, which one best describes a major concern with PII on mobile devices?Mobile devices have more processing power than other computing devices.Mobile devices typically have less processing power than other computing devices.Mobile devices often have increased complexities.Mobile devices often have difficulties to obfuscate personal data.
166 Bob needs your professional opinion on encryption capabilities. You explained to him that cryptography supports all the core principles of information security, with one exception. What is that exception?AnonymityIntegrityConfidentialityAvailability
167 Your app developers focus on the speed of app development more than security. Because of this, they use easy-to-implement encryption algorithms with known vulnerabilities. What is the result of using this type of encryption algorithm?Malware infectionModificationAttacker cracking the passwordsRemote code execution
168 After a meeting with the board of directors, your CEO is looking for a way to boost profits. He identified a need to implement cost savings on non-core-related business activities, and the suggestion was made to move the corporate email system to the cloud. You are the compliance officer tasked with making sure security and data issues are handled properly.
