Securing Assets

A retail company stores payment card data in a database on a Linux server. The security team must ensure that the database files themselves are protected if the underlying storage is physically stolen or a disk image is copied. Which control best addresses this specific threat?

You are configuring an Endpoint Security policy to harden Windows 10 devices. Which TWO of the following settings are recommended as best practice to mitigate physical access risks?

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

A security operations analyst is implementing a new endpoint detection and response (EDR) solution. The analyst must ensure that the EDR agent cannot be disabled by local administrators on endpoints. Which of the following is the MOST effective control to prevent tampering with the EDR agent?

A security operations center (SOC) analyst is reviewing firewall logs and notices that a workstation is making repeated connections to a known malicious IP address on port 443. The analyst wants to quickly identify the process responsible for these connections on the Windows workstation. Which of the following tools should the analyst use?

You are auditing your cloud environment for 'Shadow IT'. Which TWO of the following methods are effective for identifying unauthorized assets?

A security analyst is reviewing the configuration of a Windows file server that stores personnel records. The analyst wants to verify that only members of the HR group can read the payroll folder and that all other authenticated users are explicitly denied access. Which type of access control model is being applied when permissions are assigned directly to named users and groups on each file and folder?

A CCOA analyst is configuring centralized logging for a fleet of Linux servers that host sensitive customer data. The organization must ensure that authentication events and privilege escalation attempts are captured for security monitoring and compliance. Which two log sources should the analyst prioritize to detect unauthorized access and privilege escalation attempts? (Choose two.)

A CCOA analyst is reviewing the security posture of a web server that hosts a public-facing application. The analyst discovers that the server has unnecessary services running, including Telnet and FTP. Which of the following actions should the analyst recommend FIRST to reduce the attack surface?

A security operations analyst is onboarding a new subsidiary and must inventory its assets before applying controls. The subsidiary has a mix of physical servers, virtual machines, and cloud instances, and the analyst needs an authoritative record of what exists, who owns each asset, and how it is classified. Which action is the FIRST step in establishing this asset inventory?

Your vulnerability management program requires prioritizing fixes based on exploitability. Which THREE of the following factors should be included in your risk score?

When setting up a new security monitoring tool, you need to define 'Critical Assets'. Which criteria should NOT be used to determine asset criticality?

A security operations team is implementing a new endpoint detection and response (EDR) solution. They need to ensure that the EDR agent has the necessary visibility to detect malicious activity and that the collected data is protected. Which TWO of the following actions are MOST critical to achieve these goals? (Choose two.)

A manufacturing company is building a hardened baseline for its industrial control system (ICS) engineering workstations, which run Windows and connect to programmable logic controllers on the plant floor. The security team must reduce the attack surface without disrupting production. Which two controls are most appropriate to include in the baseline for these workstations? (Choose two.)

A security operations analyst is reviewing the hardening posture of a fleet of Windows Server 2022 hosts that run a custom line-of-business application requiring the legacy SMBv1 dialect for backward compatibility with an old vendor appliance. Leadership has approved a time-boxed exception but wants compensating controls. Which action BEST reduces the attack surface while honoring the approved exception?

A cloud operations team manages thousands of container workloads in Kubernetes. The CISO wants to reduce the risk that a compromised container image introduces vulnerabilities into production. The team already scans images in the CI pipeline before deployment. Which additional control most directly addresses the risk of images being replaced or tampered with after scanning but before running?

You need to ensure that all endpoints in your organization have the 'CrowdStrike Falcon' agent running and are reporting correctly. Which dashboard should you use?

You are the cybersecurity operations analyst for a hospital network. A workstation in the radiology department was compromised and used to pivot to the PACS image archive. During the post-incident review, the CISO asks which control would have most directly limited the attacker's ability to move laterally from the workstation to the archive server. Which of the following should you recommend?

You are performing a vulnerability assessment on a server. Which TWO of the following indicators would suggest an asset is part of the 'Critical' category?

You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?

Which TWO of the following are examples of good asset inventory management practices?

You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?

Which THREE of the following are examples of 'Access Control' implementations?

A security operations analyst is reviewing how a critical database server is protected. The server stores customer payment data and runs on a hardened host, but the analyst notices that the database service account can read its own data files directly from the file system, and that backup images of the volume are stored unencrypted on a shared network share. Which change MOST directly reduces the risk of bulk data exposure from a stolen backup image?

A security operations analyst is building a data classification and handling standard for a new document management platform that stores contracts, HR records, and public marketing collateral. The analyst must define controls that apply to the highest sensitivity tier. Which TWO actions are appropriate for assets classified at the highest sensitivity level? (Choose two.)

A financial services firm is inventorying its assets for a new risk assessment. The analyst must classify each asset by data sensitivity and business criticality. Which of the following best represents a 'Confidential' data classification for an asset in this environment?

You notice a surge in outbound traffic from a workstation to a series of random external IP addresses. This suggests a potential botnet infection. What is the most appropriate forensic data to collect first?

A CCOA analyst is reviewing endpoint hardening for a Windows 10 workstation used by a developer. The developer needs to run locally compiled binaries for testing but should not be able to bypass security controls. The analyst wants to prevent unauthorized executables from running while allowing approved development tools. Which Windows feature should the analyst configure to enforce application control based on code signing and reputation?

During a control review, an analyst finds that a privileged service account used by a backup platform has a password that has not rotated in three years and is stored in a plaintext configuration file on a management server. The backup platform cannot support modern authentication methods. Which compensating control BEST addresses the credential risk without breaking the backup jobs?

During an incident response engagement, an analyst must preserve volatile evidence from a compromised Windows workstation before containment. The system has been running for 36 hours and the analyst needs to capture the current state of active network connections and the processes that own them, in a form that can be used for later forensic review. Which built-in Windows utility should the analyst run first to capture this volatile data?

A security operations team is designing the asset inventory for a hybrid environment that includes on-premises servers, cloud workloads, and employee-owned mobile devices. The team wants to ensure the inventory supports both vulnerability management and incident response. Which data element is MOST important to include for every asset so that responders can quickly determine ownership and escalation paths during an incident?

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?

A security analyst is reviewing the configuration of a Windows Server 2022 file server that stores HR records. The server is a member of an Active Directory domain. The analyst finds that the local Administrators group contains the domain group 'Helpdesk_Tier1'. Helpdesk technicians need to reset user passwords and unlock accounts, but they should not have full control over the HR file server. Which action should the analyst take to enforce least privilege while preserving the technicians' ability to perform their duties?

A CCOA analyst is reviewing the organization's asset inventory practices. The analyst needs to identify TWO practices that are essential for maintaining an accurate and up-to-date asset inventory. (Choose two.)

A security operations analyst is reviewing the configuration of a newly deployed Windows Server 2022 file server that stores PII. The server has SMB signing disabled. Which of the following best describes the primary risk of leaving SMB signing disabled in this environment?

A CCOA analyst is reviewing a vulnerability scan report for a web server that hosts a public-facing application. The scan identified several vulnerabilities, including a critical remote code execution (RCE) flaw in a web framework, a medium-severity cross-site scripting (XSS) issue, and a low-severity information disclosure in an HTTP header. The RCE vulnerability has a known exploit available in the wild, but the web framework is only used for an internal administrative interface that is not accessible from the internet. The XSS vulnerability is on a public login page. Which vulnerability should the analyst prioritize for immediate remediation based on risk?

A security operations center (SOC) analyst is triaging an alert indicating that a user's workstation has been infected with malware that is attempting to communicate with a command-and-control (C2) server. The analyst wants to quickly identify the process responsible for the network connection. Which of the following tools is MOST appropriate for this task on a Windows system?

A CCOA analyst is investigating suspicious activity on a Linux web server running Apache. The analyst runs 'ss -tulpn' and sees that the server is listening on port 8443, but the organization's asset inventory lists this server as only providing HTTP on port 80 and HTTPS on port 443. The analyst needs to determine which process is bound to port 8443 and whether it is authorized. Which command should the analyst use next to identify the process name and PID associated with port 8443?

You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?

During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?

A security operations analyst at a healthcare organization is reviewing asset inventory records and discovers a database server that stores electronic protected health information (ePHI). The server is not tagged with any data classification label, and the analyst needs to ensure it complies with the organization's data classification policy before it is connected to the production network. Which action should the analyst take FIRST according to data classification and handling best practices?

A vulnerability report shows that your web application is susceptible to 'Clickjacking'. Which HTTP header should you implement to mitigate this?

You are configuring a SIEM alert to trigger when a user account is locked out. Which Windows Event ID should your filter target?

You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?

You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?

A CCOA analyst is helping to classify assets for a new cybersecurity program. The organization wants to identify which assets are most critical so that protection and monitoring efforts can be prioritized. Which criterion is the MOST appropriate basis for classifying an asset as high criticality?

A security operations center is establishing a baseline for privileged account management across its server estate. The team must reduce the risk that compromised administrative credentials lead to widespread lateral movement. Which TWO controls should the team implement to directly limit the blast radius of a compromised privileged account? (Choose two.)

You are hardening a Linux server and want to disable all unused network ports. Which command would be best to identify listening ports and their associated processes?

You are reviewing a list of vulnerabilities found by an automated scanner. Which type of vulnerability would be considered the most critical to remediate first?

A security operations analyst is implementing a hardening baseline for a fleet of Linux servers that host a web application. The organization wants to minimize the attack surface by disabling unnecessary services and configuring secure settings. The analyst has already disabled Telnet and FTP. Which additional action should the analyst take to align with the principle of least functionality?

You are analyzing logs to detect a 'Lateral Movement' attack. Which THREE of the following behaviors are common indicators?

You are setting up a secure baseline for a new server. You need to ensure the operating system logs are sent to a centralized logging server. Which service should you configure?