clapgeek logo
A corporate website is currently being redesigned, which leaves it vulnerable to security threats. Management does not want to provide an attacker with any information about the web server. Which strategy should be used to prevent an attacker from gaining unauthorized information?
An IT organization has seen a surge of ransomware and Trojan horse attacks recently.
Which action should the security team recommend to protect the IT infrastructure from commodity malware threats?
A software company is reviewing its disaster recovery plan and wants to identify the criticality of its business processes to prioritize its recovery efforts.
Which will determine the criticality of its business processes?
An IT organization has recently implemented a hybrid cloud deployment. The server team is deploying a new set of domain-joined Windows servers on cloud-based virtual machines. Users must be able to use their Active Directory credentials to sign in to applications regardless of whether they are running on Windows servers in the cloud or on-premises.
Which solution should be implemented to meet the requirements?
An organization wants to ensure that its website is free of certain vulnerabilities before the final handoff to the client. What testing method should the organization use to inspect traffic and detect potential issues?
Which risk management strategy will ensure the secure configuration and deployment of a new supply chain management system and prevent identity theft?
A large multinational corporation maintains a complex network of data centers across the world.
Which type of disaster recovery site will ensure business continuity in case of a disaster?
Which system conversion method deploys the new system while the old system is still operational in order to compare output?
A healthcare organization is concerned about the potential risks associated with unauthorized access to sensitive patient information on its endpoint devices. The organization has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this organization?
Which part of the Uniform Resource Locator (URL) identifies the server on which the web page can be found?
A healthcare provider is developing a disaster recovery plan and wants to determine the longest duration that its systems or applications can be down before causing significant damage to the business.
What is the term used to describe this metric?
During a vulnerability assessment, several end-of-life operating systems were discovered within the environment.
Which action should be taken to resolve the issue?
A retail company has recently implemented a new point of sale (POS) system that is critical to its business.
Which security control is essential for protecting the availability of the POS system?
Which action should an IT department take if an organization decides to expand its business by selling products online?
An organization wants to secure remote access to its servers and is looking for a secure protocol that can provide encryption and strong authentication. The organization wants to ensure that its servers can only be accessed by authorized users and that the data exchanged during the session is encrypted.
Which protocol meets the needs of the organization?
A cybersecurity analyst at a healthcare organization was tasked with analyzing the indicators of compromise (IOCs) to identify potential threats and vulnerabilities within the enterprise. Theanalyst notices unknown users logging on to the company's wireless local-area network (WLAN).
What is a potential vulnerability the healthcare organization is facing based on the IOCs identified?
An employee needs to execute a program from the command line.
Which peripheral device should be used?
A financial institution conducted a cybersecurity assessment, which identified several vulnerabilities, including outdated software and weak password policies. The company also needs to implement a new core banking system that can handle a large number of transactions while ensuring the security of customer data.
Which risk mitigation process is the most effective approach to address these vulnerabilities, and what is the best topology for the new core banking system?
A retail company has recently implemented a new point of sale (POS) system that is critical to its business.
Which security control is essential for protecting the availability of the POS system?
A healthcare organization is required to comply with the Health Insurance Portability and Accountability Act (HIPAA), which regulates the privacy and security of personal health information. The organization uses simple network management protocol (SNMP) to manage and monitor its network devices.
Which security control will protect the confidentiality of network device information within this organization?
The security operations center (SOC) team has been alerted about malicious traffic on the corporate network and is concerned about a distributed denial of service (DDoS) attack. An analyst has been tasked with inspecting network traffic in the on-premises data center to investigate the issue.
Which type of file should the analyst use to inspect the traffic?
A company has recently experienced a data breach in which customer information was stolen. The company is concerned about the potential for future data breaches. A review of the incident revealed that the breach originated from stolen credentials.
Which security measure will meet the needs of this company?
A financial institution conducted a cybersecurity assessment, which identified several vulnerabilities including outdated software and weak password policies. The company also needs to implement a new core banking system that can handle a large number of transactions while ensuring the security of customer data.
Which risk mitigation process is the most effective approach to address these vulnerabilities, and what is the best topology for the new core banking system?
A company recently updated its disaster recovery plan (DRP) to ensure business continuity in the event of a disruptive incident.
Which step will ensure the effectiveness of the DRP?
A retail company wants to establish the frequency at which it needs to backup its critical data to ensure it can be restored in case of a disruption with the least amount of acceptable loss in recovery.
What is the term used to describe this metric?
A professional services organization deployed security edge devices in key locations on its corporate network.
How will these devices improve the organization’s security posture?
An IT organization has recently implemented a hybrid cloud deployment. The server team is deploying a new set of domain-joined Windows servers on cloud-based virtual machines. Users must be able to use their Active Directory credentials to sign in to applications regardless of whether they are running on Windows servers in the cloud or on-premises.
A security engineer has been asked to audit unapproved changes that have recently taken place in a corporate application.
Which logging mechanism will create an audit trail?
A software development company uses file transfer protocol (FTP) to transfer software code between different teams.
Which security control is essential for protecting the integrity of software code that is transferred using FTP?
A government agency is planning a hybrid cloud deployment. Strict controls must be in place that can label classified data. The solution must ensure that access rights will be granted based on the user's government security classification.
Which type of access control should be used?
A financial institution is concerned about a potential data breach due to employees accessing the company network using personal devices. They have decided to implement a bring your own device (BYOD) policy to mitigate the risk.
Which risk mitigation strategy will reduce the risk of a data breach in this scenario?
A financial services company is concerned about the potential risks associated with sensitive customer data stored on employee laptops. The company has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this company?
What allows a user to query information from an online database with a web application without revealing what they are viewing?
Which item information should be stored in a database to determine an order total?
An IT organization needs to enable secure communication across virtual networks in Microsoft Azure and Amazon Web Services.
Which protocol will offer the most reliable and secure method for data transport?
A company recently updated its disaster recovery plan (DRP) to ensure business continuity in the event of a disruptive incident.
Which step will ensure the effectiveness of the DRP?
A consultancy organization has many employees who travel with different mobile devices. Having the employees visit an office to update their devices is not feasible due to their travel schedule.
How should the organization ensure that its employees receive the latest security updates?
A system analyst is reviewing risk documents and noticed that the date of many risks are more than three years old.
What should be proposed to leadership regarding these risks?
Which algorithm is suitable for ensuring the integrity of digital documents and detecting any unauthorized modifications?
A company wants to ensure that the integrity of its systems is maintained during the startup process.
Which security technology can ensure the integrity of the system during startup by verifying that the system has not been compromised?
An organization wants to implement a new encryption solution for a real-time video conferencing application. The organization wants to ensure that the encryption solution provides protection for the video stream without causing significant delays or latency in the conference.
Which type of encryption will meet the needs of the organization?
A security analyst for a financial institution is in the process of planning to upgrade the institution’s IT infrastructure to meet current industry standards. There are various potential risks associated with the upgrade, including data breaches, system outages, and cost overruns. The analyst is tasked with managing these risks to ensure a successful upgrade.
What is the first step in the risk management life cycle in this scenario?
A company has identified a potential risk associated with a new software implementation, which could result in a significant data breach.
Which step of the risk management life cycle involves implementing security controls to prevent the risk?
The cybersecurity analyst at a hardware company conducted a vulnerability assessment to identify potential security risks to the organization and discovered multiple vulnerabilities on the company's webpage. The analyst then provided the results to the chief information security officer (CISO), who then decided to decommission the website and create a new page with increased security controls.
Which risk mitigation strategy is demonstrated in this scenario?
A company may choose to use CDs, DVDs, hard drives, or even cloud storage for data backup.
Which aspect of data backup does this statement describe?
The security team has been notified about multiple man-in-the-middle (MITM) attacks happening on the wireless network over the past thirty days. Management has agreed to upgrade the network infrastructure to help eliminate these attacks.
An organization sends customers e-mail messages based on their purchase patterns.
Which characteristic of quality data does this represent?
Which risk management strategy will ensure that data stored on an enterprise resource planning (ERP) system is secure from exploitation in the event of a data breach?
A company is moving its applications to the cloud and is concerned about cyber security threats. The security team has been tasked with providing a comprehensive view of how attackers gainaccess, move through networks, and carry out attacks.
Which framework identifies the seven phases of an attack, from initial infiltration to post-exploitation?
A company is looking to monitor and detect any suspicious activity on its servers. The company wants to implement a security solution that can detect any unauthorized access or unusual activity on the servers.
Which security technology will meet the needs of this company?
An e-commerce company has recently experienced a data breach in which the personal and financial information of its customers was stolen. The company is concerned about the potential for future data breaches.
What is the most important factor to consider when evaluating the potential for future data breaches in this scenario?
A cybersecurity analyst at a manufacturing company is tasked with analyzing the indicators of compromise (IOCs) to identify potential threats and vulnerabilities within the organization. While viewing the security information and event management (SIEM), the analyst notices an unknown IP address logging on to the company's Secure Shell (SSH) server.
Which potential vulnerability is the manufacturing company facing?
In which type of network topology are the networked devices connected to a central device like a hub or switch?
A company has recently experienced a data breach from an insider threat and wants to implement a policy to reduce the risk of similar incidents in the future. During the incident, the insider threat accessed sensitive information stored in the administrator account from their user account. The insider threat was not in a supervisory role at the time of the incident.
Which policy should the company implement?
An organization's engineering team is developing a mobile application that uses near-field communication (NFC) capabilities but wants to ensure that information communicated using this protocol remains confidential.
An e-learning company uses Amazon Simple Storage Service (Amazon S3) to store e-books and video files that are served to customers through a custom application. The company has realized that someone has been stealing its intellectual property.
Which threat actor is most likely in this scenario?
An organization's board of directors is reviewing the risk register and attempting to evaluate whether there is too much risk for the organization.
Which metric should the board review?
TESTED 31 Jul 2025