CompTIA CySA+ Practice Tests. Mike Chapple
Читать онлайн книгу.
term is used to describe the groups of related organizations who pool resources to share cybersecurity threat information and analyses?SOCISAC CERTCIRT
11 Which one of the following threats is the most pervasive in modern computing environments?Zero-day attacksAdvanced persistent threatsCommodity malwareInsider threats
12 Singh incorporated the Cisco Talos tool into his organization's threat intelligence program. He uses it to automatically look up information about the past activity of IP addresses sending email to his mail servers. What term best describes this intelligence source?Open sourceBehavioralReputationalIndicator of compromise
13 Consider the threat modeling analysis shown here. What attack framework was used to develop this analysis?ATT&CKCyber Kill Chain STRIDEDiamond
14 Jamal is assessing the risk to his organization from their planned use of AWS Lambda, a serverless computing service that allows developers to write code and execute functions directly on the cloud platform. What cloud tier best describes this service?SaaSPaaSIaaSFaaS
15 Lauren's honeynet, shown here, is configured to use a segment of unused network space that has no legitimate servers in it. What type of threats is this design particularly useful for detecting?Zero-day attacksSQL injectionNetwork scansDDoS attacks
16 Nara is concerned about the risk of attackers conducting a brute-force attack against her organization. Which one of the following factors is Nara most likely to be able to control?Attack vectorAdversary capability LikelihoodTotal attack surface
17 Fred believes that the malware he is tracking uses a fast flux DNS network, which associates many IP addresses with a single fully qualified domain name as well as using multiple download hosts. How many distinct hosts should he review based on the NetFlow shown here?Date flow start Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows 2020-07-11 14:39:30.606 0.448 TCP 192.168.2.1:1451->10.2.3.1:443 10 1510 1 2020-07-11 14:39:30.826 0.448 TCP 10.2.3.1:443->192.168.2.1:1451 7 360 1 2020-07-11 14:45:32.495 18.492 TCP 10.6.2.4:443->192.168.2.1:1496 5 1107 1 2020-07-11 14:45:32.255 18.888 TCP 192.168.2.1:1496->10.6.2.4:443 11 1840 1 2020-07-11 14:46:54.983 0.000 TCP 192.168.2.1:1496->10.6.2.4:443 1 49 1 2020-07-11 16:45:34.764 0.362 TCP 10.6.2.4:443->192.168.2.1:4292 4 1392 1 2020-07-11 16:45:37.516 0.676 TCP 192.168.2.1:4292->10.6.2.4:443 4 462 1 2020-07-11 16:46:38.028 0.000 TCP 192.168.2.1:4292->10.6.2.4:443 2 89 1 2020-07-11 14:45:23.811 0.454 TCP 192.168.2.1:1515->10.6.2.5:443 4 263 1 2020-07-11 14:45:28.879 1.638 TCP 192.168.2.1:1505->10.6.2.5:443 18 2932 1 2020-07-11 14:45:29.087 2.288 TCP 10.6.2.5:443->192.168.2.1:1505 37 48125 1 2020-07-11 14:45:54.027 0.224 TCP 10.6.2.5:443->192.168.2.1:1515 2 1256 1 2020-07-11 14:45:58.551 4.328 TCP 192.168.2.1:1525->10.6.2.5:443 10 648 1 2020-07-11 14:45:58.759 0.920 TCP 10.6.2.5:443->192.168.2.1:1525 12 15792 1 2020-07-11 14:46:32.227 14.796 TCP 192.168.2.1:1525->10.8.2.5:443 31 1700 1 2020-07-11 14:46:52.983 0.000 TCP 192.168.2.1:1505->10.8.2.5:443 1 40 11345
18 Which one of the following functions is not a common recipient of threat intelligence information?Legal counselRisk managementSecurity engineeringDetection and monitoring
19 Alfonzo is an IT professional at a Portuguese university who is creating a cloud environment for use only by other Portuguese universities. What type of cloud deployment model is he using?Public cloudPrivate cloudHybrid cloudCommunity cloud
20 During a network reconnaissance exercise, Chris gains access to a PC located in a secure network. If Chris wants to locate database and web servers that the company uses, what command-line tool can he use to gather information about other systems on the local network without installing additional tools or sending additional traffic?pingtraceroutenmapnetstat
21 Kaiden's organization uses the AWS public cloud environment. He uses the CloudFormation tool to write scripts that create the cloud resources used by his organization. What type of service is CloudFormation?SaaSIACFaaSAPI
22 What is the default nmap scan type when nmap is not provided with a scan type flag?A TCP FIN scanA TCP connect scanA TCP SYN scanA UDP scan
23 Isaac wants to grab the banner from a remote web server using commonly available tools. Which of the following tools cannot be used to grab the banner from the remote host?NetcatTelnet WgetFTP
24 Lakshman wants to limit what potential attackers can gather during passive or semipassive reconnaissance activities. Which of the following actions will typically reduce his organization's footprint the most?Limit information available via the organizational website without authentication.Use a secure domain registration.Limit technology references in job postings.Purge all document metadata before posting.
25 Cassandra's nmap scan of an open wireless network (192.168.10/24) shows the following host at IP address 192.168.1.1. Which of the following is most likely to be the type of system at that IP address based on the scan results shown?A virtual machineA wireless routerA broadband routerA print server
26 Several organizations recently experienced security incidents when their AWS secret keys were published in public GitHub repositories. What is the most significant threat that could arise from this improper key management?Total loss of confidentialityTotal loss of integrityTotal loss of availabilityTotal loss of confidentiality, integrity, and availability
27 Latisha has local access to a Windows workstation and wants to gather information about the organization that it belongs to. What type of information can she gain if she executes the command nbtstat -c?MAC addresses and IP addresses of local systemsNetBIOS name-to-IP address mappings A list of all NetBIOS systems that the host is connected toNetBIOS MAC-to-IP address mappings
28 Tracy believes that a historic version of her target's website may contain data she needs for her reconnaissance. What tool can she use to review snapshots of the website from multiple points in time?Time MachineMorlockWayback MachineHer target's web cache
29 After Kristen received a copy of an nmap scan run by a penetration tester that her company hired, she knows that the tester used the -O flag. What type of information should she expect to see included in the output other than open ports?OCMP statusOther portsObjective port assessment data in verbose modeOperating system and Common Platform Enumeration (CPE) data
30 Andrea wants to conduct a passive footprinting exercise against a target company. Which of the following techniques is not suited to a passive footprinting process?WHOIS lookupsBanner grabbingBGP looking glass usageRegistrar checks
31 While gathering reconnaissance data for a penetration test, Charlene uses the MXToolbox MX Lookup tool. What can she determine from the response to her query shown here?The mail servers are blacklisted.The mail servers have failed an SMTP test.The mail servers are clustered.There are two MX hosts listed in DNS.
32 Alex wants to scan a protected network and has gained access to a system that can communicate to both his scanning system and the internal network, as shown in the image here. What type of nmap scan should Alex conduct to leverage this host if he cannot install nmap on system A?A reflection scanA proxy scanA randomized host scanA ping-through scan
33 As a member of a blue team, Lukas observed the following behavior during an external penetration test. What should he report to his managers at the conclusion of the test?A significant increase in latencyA significant increase in packet lossLatency and packet loss both increased.No significant issues were observed.
34 As part of an organizationwide red team exercise, Frank is able to use a known vulnerability to compromise an Apache web server. Once he has gained access, what should his next step be if he wants to use the system to pivot to protected systems behind the DMZ that the web server resides in?Vulnerability scanningPrivilege escalationPatchingInstalling additional tools
35 Maddox is conducting an inventory of access permissions on cloud-based object buckets, such as those provided by the AWS S3 service. What threat is he seeking to mitigate?Insecure APIsImproper key managementUnprotected storageInsufficient logging and monitoring
36 Alex has been asked to assess the likelihood of reconnaissance activities against her organization (a small, regional business). Her first assignment is to determine the likelihood of port scans against systems in her organization's DMZ. How should she rate the likelihood of this occurring?LowMediumHighThere is not enough information for Alex to provide a rating.
37 Lucy