Employees are having issues accessing the company's website. Some employees report
very slow performance, while others cannot the website at all. The web and security
administrators search the logs and find millions of half-open connections to port 443 on the
web server. Further analysis reveals thousands of different source IPs initiating this traffic.
Which of the following attacks is MOST likely occurring?

A.

DDoS

B.

Man-in-the-middle

C.

MAC flooding

Which of the following would be BEST to establish between organizations to define the
responsibilities of each party outline the key deliverables and include monetary penalties
for breaches to manage third-party risk?

A.

An ARO

B.

An MOU

C.

An SLA

D.

A BPA

Which of the following are the MOST likely vectors for the unauthorized inclusion of vulnerable code in a software company’s final software releases? (Select TWO.)

A.

Unsecure protocols

B.

Use of penetration-testing utilities

C.

Weak passwords

D.

Included third-party libraries

E.

Vendors/supply chain

F.

Outdated anti-malware software

A financial analyst is expecting an email containing sensitive information from a client.
When the email arrives, the analyst receives an error and is unable to open the encrypted
message. Which of the following is the MOST likely cause of the issue?

A.

The S/MME plug-in is not enabled.

B.

The SLL certificate has expired.

C.

Secure IMAP was not implemented

D.

POP3S is not supported.

Which of the following would BEST identify and remediate a data-loss event in an
enterprise using third-party, web-based services and file-sharing platforms?

A.

SIEM

B.

CASB

C.

UTM

D.

DLP

Which of the following refers to applications and systems that are used within an
organization without consent or approval?

A.

Shadow IT

B.

OSINT

C.

Dark web

D.

Insider threats

A large enterprise has moved all its data to the cloud behind strong authentication and encryption. A sales director recently had a laptop stolen and later, enterprise data was round to have been compromised database. Which of the following was the MOST likely cause?

A.

Shadow IT

B.

Credential stuffing

C.

SQL injection

D.

Man-in-the-browser

E.

Bluejacking

Which of the following is a team of people dedicated testing the effectiveness of
organizational security programs by emulating the techniques of potential attackers?

A.

Red team

B.

While team

C.

Blue team

D.

Purple team

A smart retail business has a local store and a newly established and growing online
storefront. A recent storm caused a power outage to the business and the local ISP,
resulting in several hours of lost sales and delayed order processing. The business owner
now needs to ensure two things:
* Protection from power outages
* Always-available connectivity In case of an outage
The owner has decided to implement battery backups for the computer equipment Which of
the following would BEST fulfill the owner's second need?

A.

Lease a point-to-point circuit to provide dedicated access.

B.

Connect the business router to its own dedicated UPS.

C.

Purchase services from a cloud provider for high availability

D.

Replace the business's wired network with a wireless network.

A document that appears to be malicious has been discovered in an email that was sent to a company's Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?

A.

Open the document on an air-gapped network

B.

View the document's metadata for origin clues

C.

Search for matching file hashes on malware websites

D.

Detonate the document in an analysis sandbox

A Chief Information Security Officer (CISO) needs to create a policy set that meets
international standards for data privacy and sharing. Which of the following should the CISO read and understand before writing the policies?

A.

PCI DSS

B.

GDPR

C.

NIST

D.

ISO 31000

Which of the following is MOST likely to outline the roles and responsibilities of data controllers and data processors?

A.

SSAE SOC 2

B.

PCI DSS

C.

GDPR

D.

ISO 31000