A senior security engineer flags the following log file snippet as having likely facilitated an attacker's lateral movement in a recent breach:qry_source: 19.27.214.22 TCP/53qry_dest: 199.105.22.13 TCP/53qry_type: AXFR| in comptia.org------------ directoryserver1 A 10.80.8.10------------ directoryserver2 A 10.80.8.11------------ directoryserver3 A 10.80.8.12------------ internal-dns A 10.80.9.1----------- www-int A 10.80.9.3------------ fshare A 10.80.9.4------------ sip A 10.80.9.5------------ msn-crit-apcs A 10.81.22.33Which of the following solutions, if implemented, would mitigate the risk of this issue reoccurring?

Restricting DNS traffic to UDP/53

Implementing DNS masking on internal servers

Permitting only clients from internal networks to query DNS

4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 206d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 0050 45 00 00 4c 01 03 00 34 6d be 66 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 05 00 00 70 00 00 00 10 00 00 00 d0 00 00 70 4c 01 00 00 e0 00 00 00 50 01 00 00 00 40 0000 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 02 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 0000 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00Attempts to run the code in a sandbox produce no results. Which of the following should the malware analyst do next to further analyze the malware and discover useful IoCs?

Convert the hex-encoded sample to binary and attempt to decompile it.

Run the encoded sample through an online vulnerability tool and check for any matches.

Pad the beginning and end of the sample with binary executables and attempt to execute it.

Use a disassembler on the unencoded snippet to convert from binary to ASCII text.

A security engineer is implementing a code signing requirement for all code developed by the organization. Currently, the PKI only generates website certificates. Which of the following steps should the engineer perform first?

Add a new template on the internal CA with the correct attributes.

Generate a wildcard certificate for the internal domain.

Recalculate a public/private key pair for the root CA.

Implement a SAN for all internal web applications.

Which of the following are risks associated with vendor lock-in? (Select two).

The vendor can change product offerings.

The client experiences decreased quality of service.

The client can seamlessly move data.

The vendor can change product offerings.

The client receives a sufficient level of service.

The client experiences decreased quality of service.

The client can leverage a multicloud approach.

The client experiences increased interoperability.

An auditor is reviewing the logs from a web application to determine the source of an incident. The web application architecture includes an internet-accessible application load balancer, a number of web servers in a private subnet, application servers, and one database server in a tiered configuration. The application load balancer cannot store the logs. The following are sample log snippets:Web server logs:192.168.1.10 - - [24/Oct/2020 11:24:34 +05:00] 'GET /bin/bash' HTTP/1.1' 200 453 Safari/536.36192.168.1.10 - - [24/Oct/2020 11:24:35 +05:00] 'GET / HTTP/1.1' 200 453 Safari/536.36Application server logs:24/Oct/2020 11:24:34 +05:00 - 192.168.2.11 - request does not match a known local user. Querying DB24/Oct/2020 11:24:35 +05:00 - 192.168.2.12 - root path. Begin processingDatabase server logs:24/Oct/2020 11:24:34 +05:00 [Warning] 'option read_buffer_size1 unassigned value 0 adjusted to 204824/Oct/2020 11:24:35 +05:00 [Warning] CA certificate ca.pem is self-signed.Which of the following should the auditor recommend to ensure future incidents can be traced back to the sources?

Enable the X-Forwarded-For header at the load balancer.

Install a software-based HIDS on the application servers.

Install a certificate signed by a trusted CA.

Use stored procedures on the database server.

Store the value of the $_SERVER['REMOTE_ADDR'] received by the web servers.

CompTIA SK0-005 Practice Test 14 - Free Online Exam Prep & Questions

A security engineer must ensure that sensitive corporate information is not exposed if a company laptop is stolen. Which of the following actions best addresses this requirement?

Become a Premium Member for full access

Unlock Premium Member

CompTIA SK0-005 Practice Test 14

Question

CompTIA SK0-005 Practice Tests

Practice Tests