NO.212 In reviewing service desk requests, management has requested that the security analyst investigate the requests submitted by the new human resources manager. The requests consist of “unlocking” files that belonged to the previous human manager. The security analyst has uncovered a tool that is used to display five-level passwords. This tool is being used by several members of the service desk to unlock files. The content of these particular files is highly sensitive information pertaining to personnel. Which of the following BEST describes this scenario? (Choose two.)

NO.213 The security operations team is conducting a mock forensics investigation. Which of the following should be the FIRST action taken after seizing a compromised workstation?

NO.214 A cybersecurity analyst is retained by a firm for an open investigation. Upon arrival, the cybersecurity analyst reviews several security logs.
Given the following snippet of code:

Which of the following combinations BEST describes the situation and recommendations to be made for this situation?

NO.215 A company has recently launched a new billing invoice website for a few key vendors. The cybersecurity analyst is receiving calls that the website is performing slowly and the pages sometimes time out. The analyst notices the website is receiving millions of requests, causing the service to become unavailable. Which of the following can be implemented to maintain the availability of the website?

NO.216 A vulnerability scan has returned the following information:

Which of the following describes the meaning of these results?

NO.217 An organization has a policy prohibiting remote administration of servers where web services are running. One of the Nmap scans is shown here:

Given the organization’s policy, which of the following services should be disabled on this server?

NO.218 A cybersecurity analyst is conducting a security test to ensure that information regarding the web server is protected from disclosure. The cybersecurity analyst requested an HTML file from the web server, and the response came back as follows:

Which of the following actions should be taken to remediate this security issue?

NO.219 A retail corporation with widely distributed store locations and IP space must meet PCI requirements relating to vulnerability scanning. The organization plans to outsource this function to a third party to reduce costs.
Which of the following should be used to communicate expectations related to the execution of scans?

NO.220 A software assurance lab is performing a dynamic assessment on an application by automatically generating and inputting different, random data sets to attempt to cause an error/failure condition. Which of the following software assessment capabilities is the lab performing AND during which phase of the SDLC should this occur? (Select two.)

NO.221 A cybersecurity analyst has received an alert that well-known “call home” messages are continuously observed by network sensors at the network boundary. The proxy firewall successfully drops the messages. After determining the alert was a true positive, which of the following represents the MOST likely cause?

NO.222 An analyst has received unusual alerts on the SIEM dashboard. The analyst wants to get payloads that the hackers are sending toward the target systems without impacting the business operation. Which of the following should the analyst implement?

NO.223 A security analyst has discovered that an outbound SFTP process is occurring at the same time of day for the past several days. At the time this was discovered large amounts of business critical data delivered. The authentication for this process occurred using a service account with proper credentials. The security analyst investigated the destination IP for (his transfer and discovered that this new process s not documented in the change management log. Which of the following would be the BESST course of action for the analyst to take?

NO.224 A security analyst performed a review of an organization’s software development life cycle. The analyst
reports that the life cycle does not contain in a phase in which team members evaluate and provide critical
feedback on another developer’s code. Which of the following assessment techniques is BEST for
describing the analyst’s report?

NO.225 An analyst is troubleshooting a PC that is experiencing high processor and memory consumption.
Investigation reveals the following processes are running on the system:
lsass.exe

csrss.exe

wordpad.exe

notepad.exe

Which of the following tools should the analyst utilize to determine the rogue process?

NO.226 An organization has been conducting penetration testing to identify possible network vulnerabilities. One of the security policies states that web servers and database servers must not be co-located on the same server unless one of them runs on a non-standard. The penetration tester has received the following outputs from the latest set of scans:

Which of the following servers is out of compliance?

NO.227 A security professional is analyzing the results of a network utilization report. The report includes the following information:

Which of the following servers needs further investigation?

NO.228 Review the following results:

Which of the following has occurred?

NO.229 Three similar production servers underwent a vulnerability scan. The scan results revealed that the three servers had two different vulnerabilities rated “Critical”.
The administrator observed the following about the three servers:
* The servers are not accessible by the Internet
* AV programs indicate the servers have had malware as recently as two weeks ago
* The SIEM shows unusual traffic in the last 20 days
* Integrity validation of system files indicates unauthorized modifications Which of the following assessments is valid and what is the most appropriate NEXT step?
(Select TWO).

NO.230 A security analyst is Investigating some unusual network traffic to and from one or the company’s email servers. Reviewing a packet capture, the analyst notes the following sequence of packets:

Which of the following should be the NEXT step In the Investigation?

NO.231 Given the following access log:

Which of the following accurately describes what this log displays?