NO.78 Ann, a user, states that her machine has been behaving erratically over the past week. She has
experienced slowness and input lag and found text files that appear to contain pieces of her emails or
online conversations with coworkers. The technician runs a standard virus scan but detects nothing.
Which of the following types of malware has infected the machine?

NO.79 A security analyst believes an employee’s workstation has been compromised. The analyst reviews the system logs, but does not find any attempted logins. The analyst then runs the diff command, comparing the C:WindowsSystem32 directory and the installed cache directory. The analyst finds a series of files that look suspicious.
One of the files contains the following commands:

Which of the following types of malware was used?

NO.80 An organization’s internal auditor discovers that large sums of money have recently been paid to a vendor that management does not recognize. The IT security department is asked to investigate the organizations the organization’s ERP system to determine how the accounts payable module has been used to make these vendor payments.
The IT security department finds the following security configuration for the accounts payable module:
* New Vendor Entry – Required Role: Accounts Payable Clerk
* New Vendor Approval – Required Role: Accounts Payable Clerk
* Vendor Payment Entry – Required Role: Accounts Payable Clerk
* Vendor Payment Approval – Required Role: Accounts Payable Manager
Which of the following changes to the security configuration of the accounts payable module would BEST mitigate the risk?

NO.81 A security professional wants to test a piece of malware that was isolated on a user’s computer to document its effect on a system. Which of the following is the FIRST step the security professional should take?

NO.82 As a security measure, an organization has disabled all external media from accessing the network. Since some users may have data that needs to be transferred to the network, which of the following would BEST assist a security administrator with transferring the data while keeping the internal network secure?

NO.83 A security administrator is tasked with implementing centralized management of all network devices. Network administrators will be required to logon to network devices using their LDAP credentials. All command executed by network administrators on network devices must fall within a preset list of authorized commands and must be logged to a central facility.
Which of the following configuration commands should be implemented to enforce this requirement?

NO.84 A business has recently deployed laptops to all sales employees. The laptops will be used primarily from home offices and while traveling, and a high amount of wireless mobile use is expected.
To protect the laptops while connected to untrusted wireless networks, which of the following would be the BEST method for reducing the risk of having the laptops compromised?

NO.85 A user clicked an email link that led to a website than infected the workstation with a virus.
The virus encrypted all the network shares to which the user had access. The virus was not deleted or blocked by the company’s email filter, website filter, or antivirus. Which of the following describes what occurred?

NO.86 Multiple employees receive an email with a malicious attachment that begins to encrypt their hard drives and mapped shares on their devices when it is opened.
The network and security teams perform the following actions:
* Shut down all network shares.
* Run an email search identifying all employees who received the
malicious message.
* Reimage all devices belonging to users who opened the attachment.
Next, the teams want to re-enable the network shares. Which of the following BEST describes this phase of the incident response process?

NO.87 Company A has acquired Company
B. Company A has different domains spread globally, and typically migrates its acquisitions infrastructure under its own domain infrastructure. Company B, however, cannot be merged into Company A’s domain infrastructure. Which of the following methods would allow the two companies to access one another’s resources?

NO.88 A software development company needs to augment staff by hiring consultants for a high-stakes project The project has the following requirements:
* Consultants will have access to flighty confidential, proprietary data.
* Consultants will not be provided with company-owned assets.
* Work needs to start Immediately.
* Consultants will be provided with Internal email addresses for communications.
Which of the following solutions is the BEST method lor controlling data exfiltration during this project?

NO.89 A penetration tester finds that a company’s login credentials for the email client were being sent in clear text. Which of the following should be done to provide encrypted logins to the email server?

NO.90 Which of the following attack types BEST describes a client-side attack that is used to manipulate an HTML iframe with JavaScript code via a web browser?

NO.91 Ann is the IS manager for several new systems in which the classifications of the systems’ data are being decided. She is trying to determine the sensitivity level of the data being processed. Which of the following people should she consult to determine the data classification?

NO.92 A network administrator has been alerted that web pages are experiencing long load times. After determining it is not a routing or DNS issue, the administrator logs in to the router, runs a command, and receives the following output:

Which of the following is the router experiencing?

NO.93 A security analyst is reviewing the following packet capture of an attack directed at a company’s server located in the DMZ:

Which of the following ACLs provides the BEST protection against the above attack and any further attacks from the same IP, while minimizing service interruption?

NO.94 An attacker wearing a building maintenance uniform approached a company’s receptionist asking for
access to a secure area. The receptionist asks for identification, a building access badge and checks the
company’s list approved maintenance personnel prior to granting physical access to the secure are.
The controls used by the receptionist are in place to prevent which of the following types of attacks?

NO.95 A company has migrated to two-factor authentication for accessing the corporate network, VPN, and SSO.
Several legacy applications cannot support multifactor authentication and must continue to use usernames and passwords. Which of the following should be implemented to ensure the legacy applications are as secure as possible while ensuring functionality? (Select TWO).

NO.96 An analyst is currently looking at the following output:

Which of the following security issues has been discovered based on the output?

NO.97 A company has a data classification system with definitions for “Private” and public.” The company’s security policy outlines how data should be protected based on type. The company recently added the data type
“Proprietary”.
Which of the following is the MOST likely reason the company added this data type?

NO.98 A security analyst wants to verify that a client-server (non-web) application is sending encrypted traffic.
Which of the following should the analyst use?

NO.99 A new network administrator is establishing network circuit monitoring guidelines to catch potentially malicious traffic. The administrator begins monitoring the NetFlow statistics tor the critical Internet circuit and notes the following data after two weeks.

However, after checking the statistics from the weekend following the compiled statistics the administrator notices a spike in traffic to 250Mbps sustained for one hour The administrator is able to track the source of the spike to a server in the DMZ Which of the following is the next BEST course of action the administrator should take?