QUESTION 90
You are security administrator investigating a potential infection on a network.
Click on each host and firewall. Review all logs to determine which host originated the Infecton and then deny each remaining hosts clean or infected.

QUESTION 91
Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?

QUESTION 92
Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?

QUESTION 93
Which of the following automation use cases would best enhance the security posture of an organization by rapidly updating permissions when employees leave a company?

QUESTION 94
A company is developing a business continuity strategy and needs to determine how many staff members would be required to sustain the business in the case of a disruption. Which of the following best describes this step?

QUESTION 95
Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?

QUESTION 96
Which of the following exercises should an organization use to improve its incident response process?

QUESTION 97
An administrator is reviewing a single server’s security logs and discovers the following;

Which of the following best describes the action captured in this log file?

QUESTION 98
A company is discarding a classified storage array and hires an outside vendor to complete the disposal.
Which of the following should the company request from the vendor?

QUESTION 99
During a security incident, the security operations team identified sustained network traffic from a malicious IP address:
10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization’s network. Which of the following fulfills this request?

QUESTION 100
Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message stated:
“I’m in an airport right now with no access to email. I need you to buy gift cards for employee recognition awards. Please send the gift cards to following email address.” Which of the following are thebestresponses to this situation? (Choose two).

QUESTION 101
One of a company’s vendors sent an analyst a security bulletin that recommends a BIOS update. Which of the following vulnerability types is being addressed by the patch?

QUESTION 102
A security analyst is reviewing the following logs:

Which of the following attacks ismostlikely occurring?

QUESTION 103
A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-service in a report to the management team. Which of the following best describes the threat actor in the CISO’s report?

QUESTION 104
An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device.
Which of the followingbestdescribes the user’s activity?

QUESTION 105
A systems administrator wants to prevent users from being able to access data based on their responsibilities.
The administrator also wants to apply the required access structure via a simplified format. Which of the following should the administrator apply to the site recovery resource group?

QUESTION 106
Which of the following factors are the most important to address when formulating a training curriculum plan for a security awareness program? (Select two).