Which of the following is the BEST action to foster a consistent and auditable incident response process?


A. Incent new hires to constantly update the document with external knowledge.
B. Publish the document in a central repository that is easily accessible to the organization.
C. Restrict eligibility to comment on the process to subject matter experts of each IT silo.
D. Rotate CIRT members to foster a shared responsibility model in the organization.

Which of the following risk management strategies would an organization use to maintain a legacy system with
known risks for operational purposes?


A. Acceptance
B. Transference
C. Avoidance
D. Mitigation

An administrator is experiencing issues when trying to upload a support file to a vendor. A pop-up message
reveals that a payment card number was found in the file, and the file upload was blocked. Which of the
following controls is most likely causing this issue and should be checked FIRST?


A. DLP
B. Firewall rule
C. Content filter
D. MDM
E. Application allow list

A systems administrator reports degraded performance on a virtual server. The administrator increases the
virtual memory allocation, which improves conditions, but performance degrades again after a few days. The
administrator runs an analysis tool and sees the following output:
==3214== timeAttend.exe analyzed
==3214== ERROR SUMMARY:
==3214== malloc/free: in use at exit: 4608 bytes in 18 blocks.
==3214== checked 82116 bytes
==3214== definitely lost: 4608 bytes in 18 blocks.
The administrator terminates the timeAttend.exe, observes system performance over the next few days,
and notices that the system performance does not degrade. Which of the following issues is MOST likely
occurring?


A. DLL injection
B. API attack
C. Buffer overflow
D. Memory leak

Which of the following control types is focused primarily on reducing risk before an incident occurs?


A. Preventive
B. Deterrent
C. Corrective
D. Detective

Field workers in an organization are issued mobile phones on a daily basis. All the work is performed within one
city, and the mobile phones are not used for any purpose other than work. The organization does not want
these phones used for personal purposes. The organization would like to issue the phones to workers as
permanent devices so the phones do not need to be reissued every day. Given the conditions described, which
of the following technologies would BEST meet these requirements?


A. Geofencing
B. Mobile device management
C. Containerization
D. Remote wiping

A penetration tester was able to compromise an internal server and is now trying to pivot the current session in
a network lateral movement. Which of the following tools, if available on the server, will provide the MOST
useful information for the next assessment step?


A. Autopsy
B. Cuckoo
C. Memdump
D. Nmap

A security analyst wants to fingerprint a web server. Which of the following tools will the security analyst MOST
likely use to accomplish this task?


A. nmap -p1-65535 192.168.0.10
B. dig 192.168.0.10
C. curl –head http://192.168.0.10
D. ping 192.168.0.10

Multiple business accounts were compromised a few days after a public website had its credentials database
leaked on the Internet. No business emails were identified in the breach, but the security team thinks that the
list of passwords exposed was later used to compromise business accounts. Which of the following would
mitigate the issue?


A. Complexity requirements
B. Password history
C. Acceptable use policy
D. Shared accounts

A forensic analyst needs to prove that data has not been tampered with since it was collected. Which of the
following methods will the analyst MOST likely use?


A. Look for tampering on the evidence collection bag.
B. Encrypt the collected data using asymmetric encryption.
C. Ensure proper procedures for chain of custody are being followed.
D. Calculate the checksum using a hashing algorithm.