Syo401

A penetration tester has written an application that performs a bit-by-bit XOR 0xFF operation on binaries prior to transmission over un-trusted media. Which of the following BEST describes the action performed by this type of application?
A. Hashing
B. K
C. y exchange
D. Encryption 
E. Obfuscation

2.) A company wants to ensure confidential data storage media is sanitized in such a way that the drive cannot be reused. Which of the following methods should the technician use?

A. Shredding
B. Wiping
C. Low-level formatting
D. Repartitioning
E. Ov+rwriting

4.) Which of the following specifically describes the exploitation of an interactive process to access otherwise restricted areas of the OS?

A. Privilege escalation
B. Pivot
C. +ing
D. Process affinity
E. Buffer overflow

5.) When developing an application, executing a preconfigured set of instructions is known as:
A. A code library
B. Code signing
C. A stored procedure
D. Infrastructure as a code

6.) A network administrator needs to allocate a new network for the R&D group. The network must not be accessible from the internet, regardless of the network firewall or other external misconfigurations. Which of the following settings should the network administrator implement to accomplish this?

A. Configure the OS default TTL to 1
B. Use NAT on the R&D network
C. Implement a router ACL
D. Enable protected ports on the switch

7.) An application was recently compromised after some malformed data came in via a web form. Which of the following would MOST likely have prevented this?

A. Input validation
B. Proxy server
C. Stress testing
D. Encoding

8.) When attackers use a compromised host as a platform for launching attacks deeper into a company?s network, it is said that they are:

A. Escalating privilege
B. Becoming persistent
C. Fingerprinting
D. Pivoting

9.) A new Chief Information Officer has been reviewing the badging procedures and decides to write a policy that all employees must have their badges rekeyed at least annually. Which of the following controls BEST describes this policy?
A. Physical 
B. Corrective
C. Technical
D. Administrative

10.) Which of the following refers to the term used to restore a system to its operational state?

A. MTBF
B. MTTR
C. RTO
D. RPO

11.) A security manager is creating an account management policy for a global organization with sales personnel who must access corporate network resources while traveling all over the world. Which of the following practices is the security manager MOST likely to enforce with the policy? (Select TWO)

A. Time-of-day restrictions
B. Location-based authentication
C. Password complexity
D. Standard naming convention
E. Group-based access control

12.) Which of the following would provide additional security by adding another factor to a smart card?

A. Token
B. Proximity badge
C. Physical key
D. PIN

13.) A security analyst is mitigating a pass-the-hash vulnerability on a Windows infrastructure. Given the requirement, which of the following should the security analyst do to MINIMIZE the risk?

A. Enable Kerberos
B. Disable PAP
C. Enable CHAP
D. Disable NTLM

14.) A security administrator is diagnosing a server where the CPU utilization is at 100% for 24 hours. The main culprit of CPU utilization is the antivirus program. Which of the following issues could occour if left unresolved?(Select TWO)
A. DLL injection
B. DoS attack
C. Resource exhaustion
D. MITM attack
E. Buffer overflow

15.) A company has a data classification system with definitions for ?Private? and ?Public.? The company?s security policy outlines how data should be protected based on type. The company recently added the data type ?Proprietary? which of the following is the MOST likely reason the company added this data type.
A. Reduced cost
B. Better data classification
C. Expanded authority of the privacy officer
D. More searchable data

16.) A computer emergency response team is called at midnight to investigate a case in which a mail server was restarted. After an initial investigation, it was discovered that email is being exfiltrated through an active connection. Which of the following is the NEXT step the team should take?

A. Identify the source of the active connection
B. Perform eradication of the active connection and recover
C. Format the server and restore its initial configuration
D. Perform a containment procedure by disconnecting the server

17.) A security engineer must install the same x.509 certificate on three different servers. The client application that connects to the server performs a check to ensure the certificate matches the host name. Which of the following should the security engineer use?

A. Certificate chaining
B. Extended validation certificate
C. Certificate utilizing the SAN field
D. Wildcard certificate

18.) Which of the following BEST describes an important security advantage yielded by implementing vendor diversity?

A. Configurability
B. Sustainability
C. Homogeneity
D. Resiliency

20.) Which of the following differentiates a collision attack from a rainbow table attack?

A. In a collision attack, the hash and the input data are equivalent
B. In a collision attack, the same input results in different hashes
C. A rainbow table attack performs a hash lookup
D. A rainbow table attack uses the hash as a password

Which of the following should the security administrator recommend?

A. Enforce the use of HTTPS
B. Block outbound traffic initiated from the user network
C. Block incoming traffic to the guest network
D. Allow the server network to initiate outbound connections to the internet
E. Allow incoming traffic initiated from the internet

114.) A vice president at a manufacturing organization is concerned about desktops being connected to the network. Employees need to log onto the desktops? local account to verify that a product is being created within specifications, otherwise, the desktops should be as isolated as possible. Which of the following is the BEST way to accomplish this?

196.) A network has been impacted by downtime resulting from unauthorized devices connecting directly to the wired network. The network administrator has been tasked to research and evaluate technical controls that would effectively mitigate risks associated with such devices. Which of the following capabilities would be MOST suitable for implementation in this scenario?

197.) A company is providing mobile devices to all employees. The system administrator has been tasked with providing input for the company?s mobile device policy. Which of the following are valid security concepts that the system administrator should include when offering feedback to management? (Select Two)

199.) John wants to secure an 802.11n network. Which of the following encryption methods would provide the highest level of protection?

200.) Which of the following is the MOST influential concern that contributes to an organization?s ability to extend enterprise policies to mobile devices?

201.) An application service provider has notified customers of a breach resulting from improper configuration changes. In the incident, a server intended for internal access only was made accessible to external parties. Which of the following configurations were likely to have been improperly modified resulting in the breach?

202.) Joe just installed a new (ECS) environmental control system for a room that is critical to the company?s operation and needs the ability to manage and monitor the system from any part of the network. Which of the following should the security administrator utilize to minimize the attack surface and still allow the needed access?

203.) Numerous users within an organization are unable to log into the web based financial application. The network team places a sniffer on the segment where the application resides and sees the following log entries.

Which of the following is MOST likely occurring?

204.) You want to communicate securely with a third party via email using PGP. Which of the following should you send to the third party to enable the third party to securely encrypt email replies?

205.) Which of the following should you implement if you want to preserve your internal authentication and authorization process and credentials if you are going to a cloud service provider?

206.) A university police department is housed on the first floor of a student dormitory. Which of the following would prevent students from using ARP spoofing attacks against computers at the police department?

207.) During a recent vulnerability assessment, the pen testers were able to successfully crack a large number of employee passwords. The company technology use agreement clearly states that passwords used on the company network must be at least eight characters long and contain at least one uppercase letter and special character. What can they do to standardize and enforce these rules across the entire organization to resolve this issue?

208.) You want to create several different environments for application development, testing, and quality control. Controls are being put into place to manage how software is moved into the production environment. Which of the following should the software development manager request to be put into place to implement the three new environments?

209.) A research user needs to transfer multiple terabytes of data across a network. The data is not confidential, so for performance reasons, does not need to be encrypted. However, the authentication process must be confidential. Which of the following is the BEST solution to satisfy these requirements?

210.) What technology would you use to ensure that the systems that your organization is using is going to deployed as securely as possible and prevent files and services from operation outside of a strict rule set?

211.) A security specialist has implemented antivirus software and whitelisting controls to prevent malware and unauthorized application installation on the company systems. The combination of these two technologies is an example of which of the following?

212.) What can be implemented to address the findings that revealed a company is lacking deterrent security controls?

213.) A technician is about to perform a major upgrade to the operating system of a critical system. This system is currently in a virtualization environment. Which of the following actions would result in the LEAST amount of downtime if the upgrade were to fail?

214.) What is the name for an attack that can be used to guess the PIN of an access point for the purpose of connecting to the wireless network?

215.) When performing a risk analysis, which of the following is considered a threat?

216.) A company would like to protect its e-commerce site from SQL injection and cross site scripting (XSS). The company should consider deploying which of the following technologies?

217.) A company uses digital signatures to sign contracts. The company requires external entities to create an account with a third party digital signature provider and to sign an agreement stating that they will protect the account from unauthorized access. Which of the following security goals is the company trying to address in the given scenario?

218.) The security administrator generates a key pair and sends one key inside a request file to a third party. The third party sends back a signed file. In this scenario the file sent by the administrator is a :

219.) A third party has been contracted to perform a remote penetration test of the DMZ network. The company has only provided the third party with the billing department contact information for final payment and a technical point of contact who will receive the penetration test results. Which of the following tests will be performed?

220.) An administrator is reviewing the logs for a content management system that supports the organizations public facing websites. The administrator is concerned about the number of attempted login failures from other countries for administrator accounts. Which of the following capabilities is BEST to implement if the administrator wants the system to dynamically react to such attacks?

221.) Jane, a security analyst, is monitoring the IDS console and noticed multiple connections from an internal host to a suspicious call back domain. Which of the following tools would aid her to decipher the network traffic?

222.) A high traffic website is experiencing numerous brute force attacks against its user base. The attackers are using a very large botnet to carry out the attack. As a result, many users passwords are being compromised. Which of the following actions is appropriate for the website administrators to take in order to reduce the threat from this type of attack in the future?

223.) An employee connects a wireless access point to the only jack in the conference room to provide internet access during a meeting. The access point is configured to secure its users with WPA2-TKIP. A malicious user is able to intercept clear text HTTP communication between the meeting attendees and the internet. Which of the following is the reason the malicious user is able to intercept and see the clear text communications?

224.) A user is able to access shares that store confidential information that is not related to the users current job duties. Which of the following should be implemented to prevent this from occurring?

226.) A healthcare organization is in the process of building and deploying a new web server in the DMZ that will enable public internet users the ability to securely send and receive messages from their primary care physicians. Which of the following should the security administrator consider?

227.) Which of the following should be used to implement voice encryption?

228.) A company wants to ensure that all software executing on a corporate server has been authorized to do so by a central control point. Which of the following can be implemented to enable such control?

229.) Company policy states that when a virus or malware alert is received, the suspected host is immediately removed from the company network. Which of the following BEST describes this component of incident response?

230.) A security manager has noticed several unrecognized devices connecting to the company?s internal wireless network. Only company ?issued devices should be connected to the network. Which of the following controls should be implemented to prevent the unauthorized devices from connecting to the wireless network? ( Select Two)

232.) A manager is reviewing bids for internet service in support of a new corporate office location. The location will provide 24 hour service in the organization?s global user population. In which of the following documents would the manager MOST likely find quantitative data regarding latency levels and MTTR?

233.) A system administrator decided to perform maintenance on a production server servicing retail store operations. The system rebooted in the middle of the day due to the installations of monthly operating system patches. The downtime results in lost revenue due to the system being unavailable. Which of the following would reduce the likelihood of this issue occurring again?

234.) A UNIX server recently had restricted directories deleted as the result of an insider threat. The root account was used to delete the directories while logged on at the server console. There are five administrators that know the root password. Which of the following could BEST identify the administrator that removed the restricted directories?

235.) A system administrator is part of the organizations contingency and business continuity planning process. The systems administrator and relevant team participate in the analysis of a contingency situation intended to elicit constructive discussion. Which of the following types of activity is MOST accurately described in this scenario?

236.) Recently, the desktop support group has been performing a hardware refresh and has replaced numerous computers. An auditor discovered that a number of the new computers did not have the company?s antivirus software installed on them. Which of the following could be utilized to notify the network support group when computers without the antivirus software are added to the network?

237.) Which of the following types of attacks uses email to specifically target high level officials within an organization?

238.) A security architect is supporting a project team responsible for a new extranet application. As part of their activities, the team is identifying roles within the system and documenting possible conflicts between roles that could lead to collusion between users. Which of the following principles of risk mitigation is the team implementing?

239.) A company just purchased a new digital thermostat that automatically will update to a new firmware version when needed. Upon connecting it to the network a system administrator notices that he cannot get access to the thermostat but can get access to all other network devices. Which of the following is the MOST likely reason the thermostat is not connecting to the internet?

240.) A company has a proprietary device that requires access to the network be disabled. Only authorized users should have access to the device. To further protect the device from unauthorized access, which of the following would also need to be implemented?

241.) A company uses PKI certificates stored on a smart chip enabled badge. The badge is used for a small number of devices that connect to a wireless network. A user reported that their badge was stolen. Which of the following could the security administrator implement to prevent the stolen badge from being used to compromise the wireless network?

242.) The CSO is concerned with unauthorized access at the company?s off-site datacenter. The CSO would like to enhance the security posture of the datacenter. Which of the following would BEST prevent unauthorized individuals from gaining access to the datacenter?

243.) One of the driving factors towards moving an application to a cloud infrastructure is increased application availability. In the case where a company creates a private cloud, the risk of application downtime is being:

244.) A security administrator wishes to set up a site to site IPSec VPN tunnel between two locations. Which of the following IPSec encryptions and hashing algorithms would be chosen for the least performance impact?

245.) Which of the following is a security weakness associated with software-based disk encryption?

246.) A network administrator discovers that telnet was enabled on the companys human resources payroll server and that someone outside of the HR subnet has been attempting to log into the server. The network administrator has disabled telnet on the payroll server. Which of the following is a method of tracking attempts to log onto telnet without exposing important company data?

247.) A penetration tester is attempting to determine the operating system of a remote host. Which of the following methods will provide this information?

248.) A company?s security analyst is investigating the suspected compromise of the company?s intranet web server. The compromise occurred at a time when no users were logged into the domain. Which of the following is Most likely to have prevented the attack from a new machine introduced to the corporate network?

249.) Which of the following types of attacks are MOST likely to be successful when using fuzzing against an executable program? ( select Two)

250.) Which of the following authentication services utilizes UDP for communication between client and server?

251.) As their data set rapidly grows and changes, a company is experiencing availability problems with their database. The security manager recommends switching to a more scalable system with dynamic schemas. Which of the following would meet the security manager?s requirements?

252.) A company provides wireless access for employees and a guest wireless network for visitors. The employee wireless network is encrypted and requires a password. The guest wireless network does not use an encrypted connection and does not require a password. An administrator walks by a visitors laptop and notices the following command line output: reaver ?I mon ?b 7A:E5:9A:42:2C:C1 ?vv

Which of the following should the administrator implement and why?

254.) A system administrator runs a network inventory scan every Friday at 11:00 am to track the progress of a large organizations operating system upgrade of all laptops. The system administrator discovers that some laptops are now only being reported as IP addresses. Which of the following is MOST likely the cause of this issue?

255.) A company is exploring the possibility to integrate some of its internal processes with an external cloud service provider. Which of the following should be implemented if the company wants to preserve its internal authentication and authorization process and credentials?

256.) An employee has been terminated due to inappropriate internet use. A computer forensics technician at the organization acquired an image of the hard drive and hashed it using MD5. The former employee has filed a lawsuit. The former employee?s attorney requests a copy of the image so it can be independently reviewed by the legal team. Upon receiving the image, the attorney?s technician also generates an MD5 hash of the image and comes up with a different output than what was provided. Which of the following MOST likely occurred?

257.) A security architect is supporting a project team responsible for a new extranet application. As part of their activities, the team is identifying roles within the system and documenting possible conflicts between roles that could lead to collusion between users. Which of the following principles of risk mitigation is the team implementing?

258.) A company hosts sites for multiple vendors and provides information to users globally. Which of the following is a critical security consideration in this environment?

259.) A security administrator, believing it to be a security risk, disables IGMP snooping on a switch. This breaks a video application. The application is MOST likely using:

260.) A security engineer is monitoring suspicious traffic from an internal endpoint to a malicious landing page of an external entity. The internal endpoint is configured using a limited account, is fully patched to current standards, and has current antivirus signatures. No alerts have been received involving this endpoint. The security engineer finds malicious code on the endpoint during a forensics analysis. Which of the following MOST likely explains this occurrence?

263.) A system administrator has received several service desk tickets relating to users receiving rejection notices from third-party destination email servers. The users in question were previously able to send emails to the recipients mentioned in the ticket. Which of the following items should the system administrator review to determine a possible cause for the issue?

264.) An enterprise needs to be able to receive files that contain PII from many customers at different times. The data must remain encrypted during transport and while at rest. Which of the following encryption solutions would meet both of these requirements?

265.) A security analyst has been asked to perform penetration testing against a web application being deployed for the first time. When performing the test the application stops responding and returns an error referring to failed database connections. Upon further investigation, the analyst finds the database server was inundated with commits which exhausted available space on the volume. Which of the following attacks has been performed against the database server?

266.) Virtualization would provide an ROI when implemented under which of the following situations?

267.) An organization decides to implement a BYOD policy but wants to ensure they address requirements associated with any legal investigations and controls needed to comply with the analysis and recreation of an incident. This concern is also known as which of the following?

268.) When implementing a new system, a systems administrator works with the information system owner to identify and document the responsibilities of various positions within the organization. Once responsibilities are identified, groups are created within the system to accommodate the various responsibilities of each position type, with users being placed in these groups. Which of the following principles of authorization is being developed?

270.) The SSID broadcast for a wireless router has been disabled but a network administrator notices that unauthorized users are accessing the wireless network. The administrator has determined that attackers are still able to detect the presence of the wireless network despite the fact that the SSID has been disabled. Which of the following would further obscure the presence of the wireless network?

271.) A web application is configured to target browsers and allow access to bank accounts to siphon money to a foreign account. This is an example of which of the following attacks?

275.) An auditing organization frequently deploys field employees to customer sites worldwide. While at the customer sites, the field employees often need to connect to the local network to access documents and data. Management is concerned that the field employee laptops might become infected with malware while on the customer networks. Which of the following could be deployed to decrease the amount of risk incurred by the field employees?

276.) Joe, a user, wants to configure his workstation to make certain that the certificate he receives when connecting to websites is still valid. Which of the following should Joe enable on his workstation to achieve this?

288.) A datacenter manager has been asked to prioritize critical system recovery priorities. Which of the following is the MOST critical for immediate recovery?

294.) Many employees are receiving email messages similar to the one shown below From: IT Department To: Employee Subject: Email quota exceeded Please check on the following link Http://www.getatme.infoemail.php?quota= Gb and provide your username and password to increase your email quota Upon reviewing other similar emails, the security administrator realizes that all the phishing URLs have the following common elements they all use HTTP, they all come from info domains, and they all contain the same URL. Which of the following should the security administrator configure on the corporate content filter to prevent users from accessing the phishing URL, while at the same time minimizing false positives?

306.) Which of the following are BEST used in the process of hardening a public facing web server? (Select 2)

311.) A company was recently the victim of a major attack which resulted in significant reputational loss. Joe, a member of the company incident response team, is currently reviewing Standard Operating Procedures for the team in the wake of the attack. Which of the following best identifies the stage of incident response that Joe is in?

328.) An attacker wants to exfiltrate confidential data from an organization. The attacker decides to implement steganography as the method of exfiltration. Which of the following techniques should the attacker use?

339.) A PKI architect is implementing a corporate enterprise solution. The solution will incorporate key escrow and recovery agents, as well as a tiered architecture. Which of the following is required in order to implement the architecture correctly?

345.) The network engineer for an organization intends to use certificate-based 802.1X authentication on a network. The engineer?s organization has an existing PKI that is used to issue server and user certificates. The PKI is not currently configured to support the issuance of 802.1X certificates. Which of the following represents an item the engineer MUST configure?

351.) A bank is planning to implement a third factor to protect customer ATM transactions. Which of the following could the bank implement?

356.) An auditor is reviewing the following logs from the company?s proxy server that is used to store both sensitive and public documents. The documents are edited via a client web interface, and all processing is performed on the server side.

Which of the following should the auditor recommend be implemented?

361.) An administrator is reviewing the logs for a content management system that supports the organization?s public-facing website. The administrator is concerned about the number of attempted login failures for administrator accounts from other countries. Which of the following capabilities is BEST to implement if the administrator wants the system to react dynamically to such attacks?

362.) y recent security breach at an organization revealed that the attack leveraged a telnet server that had not been used for some time. Below are partial results of an audit that occurred a week before the breach was detected. OPEN PORTS---TCP 23, TCP 80, TCP 443 OS PATCH LEVEL-CURRENT PASSWORD AUDIT-PASS, STRONG FILE INTEGRITY-PASS. Which of the following could have mitigated or deterred this breach?

366.) After installing new digital certificates on a company web server, the network administrator wants to securely store the keys so that no one individual is able to use the keys on any other system. Which of the following would allow the network administrator to achieve this goal?

372.) A developer is programming an SSO module to assist an organization?s internal users with password management. As part of the implementation plan, each user will be required to sign in with existing credentials and submit a new password for the SSO system due to increased security requirements. The developer has been tasked by the security lead to harden the application against automated attacks using the existing credentials. Which of the following will provide an additional security layer against unauthorized access?

377.) A company has classified the following database records

382.) A datacenter has suffered repeated burglaries that lead to equipment theft and arson. In the past, the thieves have demonstrated a determination to bypass any installed safeguards. After mantraps had been installed to prevent tailgating, the thieves crashed through the wall of the datacenter with a vehicle after normal business hours. Which of the following options could further improve the physical safety and security of the datacenter? (select TWO).

.

392.) The first responder to an incident has been asked to provide an after action report. This supports which of the following Incident Response procedures?

397.) The network engineer for an organization intends to use certificate-based 802.1X authentication on a network. The engineer's organization has an existing PKI that is used to issue server and user certificates. The PKI is currently not configured to support the issuance of 802.1X certificates. Which of the following represents an item the engineer MUST configure?

400.) Analysis of a recent security breach at an organization revealed that the attack leveraged a telnet server that had not been used in some time. Below are partial results of an audit that occurred a week before the breach was detected.

BEFORE

AFTER

MAC Address

402.) A recent policy change at an organization requires that all remote access connections to and from file servers at remote locations must be encrypted. Which of the following protocols would accomplish this new objective? (Select TWO).

404.) An organization that uses a cloud infrastructure to present a payment portal is using:

405.) A forensics investigator needs to be able to prove that digital evidence was not tampered with after being taken into custody. Which of teh following is useful in this scenario?

406.) A penetration tester is attempting to determine the operating system of a remote host. Which of the following will provide this information?

407.) A company is hosting both sensitive and public information at a cloud provider. Prior to the company going out of business, the administrator will decommission all virtual servers hosted in the cloud. When wiping the virtual hard drive, which of the following should be removed?

408.) A software development manager needs to create several different environments for application development, testing, and quality control. Controls are being put in place to manage how software is moved into the production environment. Which of the following should the software development manager request be put in place to implement the three new environments?

432.) Which of the following is a Data Loss Prevention (DLP) strategy and is MOST useful for securing data in use?

444.) A company discovers an unauthorized device accessing network resources through one of many network drops in a common area used by visitors. The company decides that is wants to quickly prevent unauthorized devices from accessing the network but policy prevents the company from making changes on every connecting client. Which of the following should the company implement?

457.) Environmental control measures include which of the following?

1.) CCTV and Motion=Detective