A security consultant has been asked to identify a simple, secure solution for a small business with a single access point. A single SSID and no guest access will be used. The customer facility is located in a crowded area of town. The customer has asked that the solution require low administrative overhead. Which of the following should the security consultant recommend?
A. WPA3-Personal
B. WPA2-TKIP
C. WPA2-Enterprise
D. WPA3-Enterprise
Show Answer
Correct Answer: A
Explanation: WPA3-Personal uses SAE for strong password-based authentication and does not require a RADIUS server, so it provides a secure, low-overhead fit for a small business with one SSID and no guest access. WPA2-TKIP is outdated, while the Enterprise options add authentication infrastructure and administration.
Question 148
A security manager is creating a connection between two networks that process data at different classification levels. The main goal of this connection is to pass data from the higher classification side to the lower classification side without causing spillage. Only approved fie types and content will be allowed. Which of the following technologies would best meet this objective?
A. Network access control
B. File integrity monitoring
C. Cross-domain solution
D. Microsegmentation
Show Answer
Correct Answer: C
Explanation: A cross-domain solution (CDS) provides controlled transfer between networks at different classification levels. It can enforce rules that allow only approved file types and content to pass, helping prevent data spillage.
Question 149
A mobile device hardware manufacturer receives the following requirements from a company that wants to produce and sell a new mobile platform:
• The platform should store biometric data.
• The platform should prevent unapproved firmware from being loaded.
• A tamper-resistant, hardware-based counter should track if unapproved firmware was loaded.
Which of the following should the hardware manufacturer implement? (Choose three).
A. ASLR
B. NX
C. eFuse
D. SED
E. SELinux
F. Secure boot
G. Shell restriction
H. Secure enclave
Show Answer
Correct Answer: C, F, H
Explanation: An eFuse can provide a tamper-resistant hardware record or counter for firmware state changes. Secure boot verifies firmware before loading it, preventing unapproved firmware from running. A secure enclave provides isolated hardware protection for storing and processing biometric data.
Question 150
A software development company needs to mitigate third-party risks to its software supply chain. Which of the following techniques should the company use in the development environment to best meet this objective?
A. Performing software composition analysis
B. Requiring multifactor authentication
C. Establishing coding standards and monitoring for compliance
D. Implementing a robust unit and regression-testing scheme
Show Answer
Correct Answer: A
Explanation: Software composition analysis inventories and evaluates third-party libraries and other dependencies, helping identify vulnerable or otherwise risky components in the software supply chain.
Question 151
A security architect wants to prevent security impacts from input into data fields, such as the following:
'AND 1=1#
Which of the following would best accomplish this objective?
A. APIs
B. Coding standards
C. Base64 encoding
D. Sandboxing
Show Answer
Correct Answer: B
Explanation: Secure coding standards can require practices such as parameterized queries and appropriate input validation, which prevent user input like `AND 1=1#` from being interpreted as SQL. Base64 encoding and sandboxing do not directly prevent injection, and APIs alone do not ensure safe input handling.
Question 152
An IT department is currently working to implement an enterprise DLP solution. Due diligence and best practices must be followed in regard to mitigating risk. Which of the following ensures that authorized modifications are well planned and executed?
A. Risk management
B. Network management
C. Configuration management
D. Change management
Show Answer
Correct Answer: D
Explanation: Change management ensures authorized modifications are reviewed, approved, planned, tested, and implemented in a controlled manner.
Question 153
Due to budget constraints, an organization created a policy that only permits vulnerabilities rated high and critical according to CVSS to be fixed or mitigated. A security analyst notices that many vulnerabilities that were previously scored as medium are now breaching higher thresholds. Upon further investigation, the analyst notices certain ratings are not aligned with the approved system categorization. Which of the following can the analyst do to get a better picture of the risk while adhering to the organization’s policy?
A. Align the exploitability metrics to the predetermined system categorization.
B. Align the remediation levels to the predetermined system categorization.
C. Align the impact subscore requirements to the predetermined system categorization.
D. Align the attack vectors to the predetermined system categorization.
Show Answer
Correct Answer: C
Explanation: Align the CVSS impact subscore requirements (confidentiality, integrity, and availability) with the approved system categorization. These environmental metrics reflect the system’s business impact, helping prioritize risk more accurately while retaining the organization’s high/critical remediation policy.
Question 154
A company that uses several cloud applications wants to property identify:
• All the devices potentially affected by a given vulnerability
• All the internal servers utilizing the same physical switch
• The number of endpoints using a particular operating system
Which of the following is the best way to meet the requirements?
A. SBoM
B. CASB
C. GRC
D. CMDB
Show Answer
Correct Answer: D
Explanation: A configuration management database (CMDB) tracks IT assets and their relationships, supporting vulnerability impact analysis, network-topology queries such as shared switch usage, and endpoint counts by operating system.
Question 155
A university issues badges through a homegrown identity management system to all staff and students. Each week during the summer, temporary summer school students arrive and need to be issued a badge to access minimal campus resources. The security team received a report from an outside auditor indicating the homegrown system is not consistent with best practices in the security field. Which of the following should the security team recommend first?
A. Investigating a potential threat identified in logs related to the identity management system
B. Updating the identity management system to use discretionary access control
C. Beginning research on two-factor authentication to later introduce into the identity management system
D. Working with procurement and creating a requirements document to select a new IAM system/vendor
Show Answer
Correct Answer: D
Explanation: A homegrown identity management system that fails to meet security best practices should be replaced with a properly evaluated IAM solution. The first step is to work with procurement to define requirements and select a suitable system. The other options address an unrelated log investigation or isolated controls rather than the underlying IAM problem.
Question 156
A new, online file hosting service is being offered. The service has the following security requirements:
• Threats to customer data integrity and availability should be remediated first.
• The environment should be dynamic to match increasing customer demands.
• The solution should not interfere with customers’ ability to access their data at anytime.
• Security analysts should focus on high-risk items.
Which of the following would best satisfy the requirements?
A. Expanding the use of IPS and NGFW devices throughout the environment
B. Increasing the number of analysts to identify risks that need remediation
C. Implementing a SOAR solution to address known threats
D. Integrating enterprise threat feeds in the existing SIEM
Show Answer
Correct Answer: C
Explanation: A SOAR solution can automatically respond to known threats and prioritize remediation, helping protect data integrity and availability as demand changes. Automating routine responses also lets analysts focus on higher-risk issues, without relying on additional inline devices that could disrupt customer access.
$19
Get all 406 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.