When used with an access control vestibule which of the following would provide the best prevention against tailgating?
A. PIN
B. Access card
C. Security guard
D. CCTV
Show Answer
Correct Answer: C
Explanation: An access control vestibule (mantrap) is designed to control entry, but preventing tailgating is most effective when someone can actively observe, challenge, and intervene. A security guard can verify that only authorized individuals enter and stop attempts to follow another person through the vestibule. PINs and access cards authenticate users but do not by themselves prevent someone from following closely behind. CCTV provides monitoring and evidence but does not actively prevent tailgating.
Question 4
While investigating a possible incident, a security analyst discovers the following:
Which of the following should the analyst do first?
A. Implement a WAF.
B. Disable the query.php script.
C. Block brute-force attempts on temporary users.
D. Check the users table for new accounts.
Show Answer
Correct Answer: D
Explanation: The log shows a likely SQL injection attempt targeting the users table, but an HTTP 200 response alone does not confirm that it succeeded. First check whether an unauthorized account was created; then take appropriate containment steps based on what you find.
Question 5
Which of the following steps should be taken before mitigating a vulnerability in a production server?
A. Escalate the issue to the SDLC team.
B. Use the IR plan to evaluate the changes.
C. Perform a risk assessment to classify the vulnerability.
D. Refer to the change management policy.
Show Answer
Correct Answer: D
Explanation: Before changing a production server, follow the organization’s change management policy. It ensures the mitigation is reviewed, approved, scheduled, and documented to reduce the risk of disrupting production. Risk assessment helps prioritize vulnerabilities, but the question focuses on implementing a change in production.
Question 5
Which of the following analysis methods allows an organization to measure the exposure factor associated with organizational assets?
A. Heuristic
B. Quantitative
C. User-driven
D. Trend-based
Show Answer
Correct Answer: B
Explanation: Quantitative risk analysis measures risk using numerical values. The exposure factor (EF) is a core quantitative metric representing the percentage of an asset's value lost in a specific incident, and it is used with asset value to calculate single loss expectancy (SLE).
Question 5
While reviewing logs, a security administrator identifies the following code:
Which of the following best describes the vulnerability being exploited?
A. XSS
B. SQLi
C. DDoS
D. CSRF
Show Answer
Correct Answer: A
Explanation: The `<script>` tag indicates JavaScript being injected into a page, which is characteristic of an attempted cross-site scripting (XSS) attack. The snippet is incomplete, but among the options XSS is the best match.
Question 6
A security analyst is reviewing logs and discovers the following:
Which of the following should be used to best mitigate this type of attack?
A. Input sanitization
B. Secure cookies
C. Static code analysis
D. Sandboxing
Show Answer
Correct Answer: A
Explanation: The User-Agent contains shell-like syntax intended to trigger command execution. Validate and safely handle untrusted input such as HTTP headers, and avoid passing it to a shell without proper parameterization. Secure cookies and sandboxing do not directly prevent this input-based attack.
Question 6
A security team receives reports about high latency and complete network unavailability throughout most of the office building. Flow logs from the campus switches show high traffic on TCP 445. Which of the following is most likely the root cause of this incident?
A. Buffer overflow
B. NTP amplification attack
C. Worm
D. DoS attack
Show Answer
Correct Answer: C
Explanation: TCP port 445 is used by SMB. A sudden surge of TCP 445 traffic across a campus network, accompanied by widespread latency and outages, is most consistent with a self-propagating SMB worm scanning and infecting hosts (for example, behavior similar to WannaCry). An NTP amplification attack uses UDP port 123, a generic DoS does not specifically explain the SMB-focused traffic, and a buffer overflow is an exploit type rather than the likely network-wide root cause.
Question 6
A company is implementing a policy to allow employees to use their personal equipment for work. However, the company wants to ensure that only company-approved applications can be installed. Which of the following addresses this concern?
A. MDM
B. Containerization
C. DLP
D. FIM
Show Answer
Correct Answer: A
Explanation: MDM can enforce application policies on managed or BYOD devices, including restricting installation or use to company-approved apps. Containerization separates work data and apps from personal data, while DLP and FIM address data protection and file integrity, respectively.
Question 7
Which of the following is most likely a security concern when installing and using low-cost IoT devices in infrastructure environments?
A. Country of origin
B. Device responsiveness
C. Ease of deployment
D. Storage of data
Show Answer
Correct Answer: D
Explanation: Low-cost IoT devices may have weak protections for data they store, such as inadequate encryption or access controls, putting sensitive infrastructure data at risk. Responsiveness and ease of deployment are mainly operational considerations, and country of origin alone does not establish a security weakness.
Question 7
A company's online shopping website became unusable shortly after midnight on January 30, 2023. When a security analyst reviewed the database server, the analyst noticed the following code used for backing up data:
Which of the following should the analyst do next?
A. Check for recently terminated DBAs.
B. Review WAF logs for evidence of command injection.
C. Scan the database server for malware.
D. Search the web server for ransomware notes.
Show Answer
Correct Answer: A
Explanation: The date-triggered `DROP DATABASE` statement is a logic bomb embedded in the database backup code, suggesting it was deliberately planted by someone with privileged access. The analyst should investigate potential insider involvement, including checking for recently terminated DBAs. WAF logs are less directly relevant because the destructive code is already present in the server-side backup process.
$19
Get all 609 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
