NO.47 An analyst must review a new cloud-based SIEM solution. Which of the following should the analyst do FIRST prior to discussing the company’s needs?

NO.48 Which of the following is a best practice when sending a file/data to another individual in an organization?

NO.49 A security analyst is conducting a post-incident log analysis to determine which indicators can be used to detect further occurrences of a data exfiltration incident. The analyst determines backups were not performed during this time and reviews the following:

Which of the following should the analyst review to find out how the data was exfiltrated?

NO.50 Which of the following has the GREATEST impact to the data retention policies of an organization?

NO.51 A security analyst performs various types of vulnerability scans. Review the vulnerability scan results to determine the type of scan that was executed and if a false positive occurred for each device.
Instructions:
Select the Results Generated drop-down option to determine if the results were generated from a credentialed scan, non-credentialed scan, or a compliance scan.
For ONLY the credentialed and non-credentialed scans, evaluate the results for false positives and check the findings that display false positives. NOTE: If you would like to uncheck an option that is currently selected, click on the option a second time.
Lastly, based on the vulnerability scan results, identify the type of Server by dragging the Server to the results.
The Linux Web Server, File-Print Server and Directory Server are draggable.
If at any time you would like to bring back the initial state of the simulation, please select the Reset All button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

NO.52 A company wants to establish a threat-hunting team. Which of the following BEST describes the rationale for integration intelligence into hunt operations?

NO.53 A compliance officer of a large organization has reviewed the firm’s vendor management program but has discovered there are no controls defined to evaluate third-party risk or hardware source authenticity. The compliance officer wants to gain some level of assurance on a recurring basis regarding the implementation of controls by third parties.
Which of the following would BEST satisfy the objectives defined by the compliance officer? (Choose two.)

NO.54 Management wants to scan servers for vulnerabilities on a periodic basis. Management has decided that the scan frequency should be determined only by vendor patch schedules and the organization’s application deployment schedule. Which of the following would force the organization to conduct an out-of- cycle vulnerability scan?

NO.55 A security technician is testing a solution that will prevent outside entities from spoofing the company’s email domain, which is compatia.org. The testing is successful, and the security technician is prepared to fully implement the solution. Which of the following actions should the technician take to accomplish this task?

NO.56 A security analyst on the threat-hunting team has developed a list of unneeded, benign services that are currently running as part of the standard OS deployment for workstations. The analyst will provide this list to the operations team to create a policy that will automatically disable the services for all workstations in the organization.
Which of the following BEST describes the security analyst’s goal?

NO.57 Which of the following BEST describes the process by which code is developed, tested, and deployed in small batches?

NO.58 Several accounting department users are reporting unusual Internet traffic in the browsing history of their workstations after returning to work and logging in. The building security team informs the IT security team that the cleaning staff was caught using the systems after the accounting department users left for the day. Which of the following steps should the IT security team take to help prevent this from happening again? (Choose two.)

NO.59 After examine a header and footer file, a security analyst begins reconstructing files by scanning the raw data bytes of a hard disk and rebuilding them. Which of the following techniques is the analyst using?

NO.60 Which of the following is the BEST way to share incident-related artifacts to provide non-repudiation?

NO.61 While analyzing logs from a WAF, a cybersecurity analyst finds the following:

Which of the following BEST describes what the analyst has found?

NO.62 Clients are unable to access a company’s API to obtain pricing dat
a. An analyst discovers sources other than
clients are scraping the API for data, which is causing the servers to exceed available resources. Which of the
following would be BEST to protect the availability of the APIs?

NO.63 An internally developed file-monitoring system identified the following except as causing a program to crash often:

Which of the following should a security analyst recommend to fix the issue?

NO.64 Which of the following would MOST likely be included in the incident response procedure after a security breach of customer PII?

NO.65 A system administrator has reviewed the following output:

Which of the following can a system administrator infer from the above output?

NO.66 A security team wants to make SaaS solutions accessible from only the corporate campus Which of the following would BEST accomplish this goal?

NO.67 A security analyst is reviewing the following log from an email security service.

Which of the following BEST describes the reason why the email was blocked?

NO.68 A product security analyst has been assigned to evaluate and validate a new products security capabilities Part ot the evaluation involves reviewing design changes at specific intervals tor security deficiencies recommending changes and checking for changes at the next checkpoint Which of the following BEST defines the activity being conducted?

NO.69 A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geographic zones, all of which were initiated through the web-based mail server. The logs indicate all domain accounts experienced two login attempts during the same time frame.
Which of the following is the MOST likely cause of this issue?