Which of the following provides the details about the terms of a test with a third-party penetration tester?
Rules of engagement (ROE) outline the scope, objectives, and limitations of a penetration test, including timelines, targets, and permitted activities. This document ensures both parties are aligned on the testing parameters and expectations.
A company plans to secure its systems by:\n• Preventing users from sending sensitive data over corporate email\n• Restricting access to potentially harmful websites\nWhich of the following features should the company set up? (Select 2 Answers)
Data Loss Prevention (DLP) software inspects outgoing emails in real time to identify and block any sensitive information from leaving the network. DNS filtering complements this by preventing users from reaching known malicious or unauthorized websites, thereby enforcing web-use policies. Together, these controls create a layered defense that addresses both data exfiltration and web-based threats.
Which of the following data states applies to data that is being actively processed by a database server?
Data being actively processed is in the 'in use' state.
A company discovers suspicious transactions that were entered into the company’s database and attached to a user account that was created as a trap for malicious activity. Which of the following is the user account an example of?
A honeytoken is a decoy account or data element designed to detect unauthorized activity. When an attacker interacts with the honeytoken, it triggers an alert to the security team. This technique helps in early detection and forensic investigation.
An IT manager is creating a documented plan describing how the organization will keep operating in the event of a global incident. Which of the following plans is being created?
A business continuity plan ensures that critical operations continue during and after major incidents. Disaster recovery focuses only on restoring IT systems, while business continuity covers the entire organization’s ability to function.
A recent review of logs indicate many attempts to join an internal wireless network from external devices. The connections appear to be originating from surrounding buildings. Which of the following would best help minimize the visibility of the wireless network?
Heat maps visualize wireless signal strength and coverage areas. By analyzing these maps, administrators can adjust transmit power and antenna placement to limit signal leakage. This reduces unauthorized attempts from outside the intended coverage zone.
A security engineer has been assigned to work on a request from outside counsel. The security engineer must provide all email correspondence within a specific date range. Which of the following actions should be taken first in response to the request?
Issuing litigation hold notifications immediately preserves relevant data by preventing its alteration or deletion. This action safeguards all potentially responsive emails until they can be collected and reviewed.
Which of the following is the MOST effective way to secure DevOps pipelines?
Automation ensures consistent application of security controls throughout the pipeline and reduces human error.
Which of the following best describes the motivation of a worker who steals proprietary data to sell to a competitor?
The motivation for the worker's actions is financial gain, as the worker intends to profit by selling proprietary data to a competitor.
A user attempts to send an invoice to a customer. When the user follows up with the customer to see if the invoice was received, the customer informs the user that it went to the spam folder. The management team has asked the systems administrator to implement measures to reduce the likelihood of this happening again. Which of the following should the systems administrator implement?
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM to help ensure that legitimate emails are properly authenticated and less likely to be flagged as spam. It also allows domain owners to instruct email servers on how to handle unauthenticated messages and receive reports.
After a company was compromised, customers initiated a lawsuit. The company's attorneys requested a legal hold. Which of the following actions will the security team most likely be required to take?
A legal hold requires preserving all communications and evidence related to the security breach until the legal team releases the hold. This ensures no critical records are deleted or destroyed before the case is resolved.
Which of the following activities are associated with vulnerability management? (Choose two.)
Vulnerability management involves reporting vulnerabilities and prioritizing them to ensure the most critical ones are addressed first.
Which of the following are activities that should be performed during the containment phase of the incident response process? (Select two).
During the containment phase, the focus is on stopping the attack and notifying stakeholders to control the damage.
After three contract revisions, HR needs to track changes. Which process should they follow?
Version control systems track each document revision, including who made the change and when. They provide history, enable comparison between versions, and allow rollback to prior drafts.
A company is concerned about theft of client data from decommissioned laptops. Which of the following is the most cost-effective method to decrease this risk?
Secure wiping overwrites data to prevent recovery before disposal. It’s faster and more cost-effective than physical destruction or shredding.
Quiz Complete!
Domain 4: Security Operations