Sec+ Questions

In the process of obtaining a digital certificate, which entity may a certificate authority rely on to perform the validation of the certificate signing request (CSR)?

Online Certificate Status Protocol

Certificate revocation list

Root authority

Registration authority

Registration authority is the correct answer. Registration authority (RA) is an entity that is certified by a root certificate authority and is authorized to issue certificates for specific uses only. The RA can perform the validation of the certificate signing request (CSR) on behalf of the certificate authority.

A root authority, or root CA, is the top-level certificate authority in a certificate chain. It is responsible for issuing certificates to subordinate CAs, not for validating CSRs.

A Certificate revocation list (CRL) is a list of certificates that have been revoked before their scheduled expiration date and are no longer valid. It does not perform any validation of CSRs.

The Online Certificate Status Protocol (OCSP) is an internet protocol used to obtain the revocation status of a digital certificate. It does not perform any validation of CSRs.

Which of the following would require that a certificate be placed on the CRL?

The certificate validity period is exceeded.

The encryption key algorithm is revealed.

The signature key size is revealed.

The private key is compromised.

Certificates are published to the certificate revocation list (CRL) when a condition compromises the integrity of the certificate. If the private key is compromised (discovered), the certificate is no longer proof of identity.

Certificates do not need to be placed on the CRL if their validity period expires. In this case, the certificate simply expires. Knowing the signature key size or the encryption key algorithm does not compromise the integrity of the certificate.

An SSL client has determined that the certificate authority (CA) issuing a server's certificate is on its list of trusted CAs.

What is the next step in verifying the server's identity?

The master secret is generated from common key code.

The domain on the server certificate must match the CA's domain name.

The post-master secret must initiate subsequent communication.

The CA's public key validates the CA's digital signature on the server certificate.

Once an SSL client has identified a CA as trusted, it uses the CA's public key to validate the CA's digital signature on the server certificate. If the digital signature can be verified, the client accepts the server certificate as a valid certificate issued by a trusted CA.

SSL clients verify a server's identity using the following steps:

1. The client checks the server's certificate validity period. The authentication process stops if the current date and time fall outside of the validity period.

2. The client verifies that the issuing certificate authority is on its list of trusted CAs.

3. The client uses the CA's public key to validate the CA's digital signature on the server certificate. If the digital signature can be verified, the client accepts the server certificate as a valid certificate issued by a trusted CA.

4. To protect against man-in-the-middle attacks, the client compares the actual DNS name of the server to the DNS name on the certificate.

The network administrator for an international e-commerce company that operates multiple online stores must ensure secure communication across various subdomains.

To streamline secure sockets layer/transport layer security (SSL/TLS) certificate management and implement a robust public key infrastructure (PKI), the network administrator must identify the most suitable solution for efficiently securing the company's numerous subdomains within the PKI.

What is the MOST suitable solution for efficiently securing the multiple subdomains of the company's online stores within the PKI?

Certificate pinning

Certificate revocation lists (CRLs)

Self-signed certificates

Wildcard certificates

By using wildcard certificates, the company can secure all subdomains under a single certificate, ensuring efficient management and reducing administrative overhead. Wildcard certificates streamline the certificate deployment process and simplify ongoing maintenance tasks, leading to improved operational efficiency.

Self-signed certificates lack the trust and validation provided by a reputable certificate authority.

Certificate revocation lists (CRLs) provide information about revoked certificates but do not address the efficient management of multiple subdomains.

Certificate pinning is a mechanism to ensure trust in specific certificates but not specifically designed to manage multiple subdomains within a PKI efficiently.

Which of the following statements accurately describes the root of trust model in a public key infrastructure (PKI)?

In the root of trust model, the root certificate is issued by a third-party CA, not the organization's own CA.

The root of trust model involves a root certificate that is issued by a user, not a CA.

The root of trust model defines how users and different CAs can trust one another, with each CA issuing itself a root certificate.

The root of trust model involves multiple root certificates, each issued by a different certificate authority (CA).

The root of trust model defines how users and different CAs can trust one another, with each CA issuing itself a root certificate is the correct answer. The root of trust model defines how users and different CAs can trust one another, with each CA issuing itself a root certificate. This is the core concept of the root of trust model, where the root certificate is self-signed by the CA, and installing the CA's root certificate means that hosts will automatically trust any certificates signed by that CA.

The root of trust model involves multiple root certificates, each issued by a different certificate authority (CA) is incorrect because in the root of trust model, there is typically one root certificate that is self-signed by the CA.

In the root of trust model, the root certificate is issued by a third-party CA, not the organization's own CA is incorrect because in the root of trust model, the root certificate is self-signed by the CA itself, not a third-party CA.

The root of trust model involves a root certificate that is issued by a user, not a CA is incorrect because in the root of trust model, the root certificate is issued by the CA, not a user.

NIST

National Institute of Standards and Technology. Develops computer security standards used by US federal agencies an dpublishes cybersecurity best practice guides and research.

You are a network administrator for a large multinational corporation. The corporation has offices in multiple countries and uses various software products from different vendors.

The CEO wants to implement a system that stores information about users, computers, security groups/roles, and services, and allows for interoperability between different vendors' products.

Which directory service would you recommend?

A

Lightweight Directory Access Protocol (LDAP)

B

Active Directory

C

X.500

D

Novell Directory Services (NDS)

Lightweight Directory Access Protocol (LDAP) is the correct answer. LDAP is a protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information. Most directory services, including those from different vendors, are based on LDAP, which allows for interoperability.

Active Directory is incorrect because while Active Directory is a directory service, it is a Microsoft product and may not offer the desired level of interoperability with products from different vendors.

Novell Directory Services (NDS) is incorrect because NDS, while a directory service, is a Novell product and may not offer the desired level of interoperability with products from different vendors.

X.500 is incorrect because while X.500 is a standard for directory services, it is not as widely used as LDAP and may not offer the desired level of interoperability with products from different vendors.

Which of the following is a privilege or action that can be taken on a system?

answer

SACL

Permissions

DACL

User rights

User Rights

Explanation

On a Microsoft system, a user right is a privilege or action that can be taken on a system: such as logging on, shutting down, backing up, or modifying the date and time. User rights apply to the entire system.

A discretionary access control list (DACL) is an implementation of discretionary access control (DAC).

Microsoft uses a system access control list (SACL) for auditing in order to identify past actions performed by users on an object.

Permissions define the rights and access users and groups have with objects. Permissions are applied to objects such as files and folders.

Which type of group can be used for controlling access to objects?

answer

Authorization

Security

Distribution

DACL

Security

Only security groups can be used for controlling access to objects.

A discretionary access control list (DACL) is an implementation of discretionary access control (DAC).

Distribution groups cannot be used for controlling access to objects.

Authorization is the process of controlling access to resources such as computers, files, or printers.

Which security mechanism uses a unique list that meets the following specifications:

• The list is embedded directly in the object itself.

• The list defines which subjects have access to certain objects.

• The list specifies the level or type of access allowed to certain objects.

User ACL

Conditional access

Mandatory access control

Hashing

user ACL

A user ACL (user access control list) is a security mechanism that defines which subjects have access to certain objects and the level or type of access allowed. This security mechanism is unique for each object and embedded directly in the object itself.

Mandatory access control (MAC) is an access control system based on classifications of subjects and objects to define and control access.

Conditional access is a way to enforce access control while also encouraging users to be productive wherever they are.

Hashing is a cryptographic tool that creates an identification code that is employed to detect changes in data.

You want to ensure that all users in the Development OU have a common set of network communication security settings applied.

Which action should you take?

Create a GPO computer policy for the computers in the Development OU.

Create a GPO folder policy for the folders containing the files.

Create a GPO computer policy for the Computers container.

Create a GPO user policy for the Development OU

Create a GPO computer policy for the computers in the Development OU.

Network communication security settings are configured in the Computer Policies section of a GPO.

Built-in containers (such as the Computers container) and folders cannot be linked to a GPO.

You are the IT security manager at a large organization that is implementing a single sign-on (SSO) solution for the first time. The SSO solution uses the Kerberos protocol. During a meeting, your team discusses the following options for the initial step in the Kerberos authentication process. Which option should be the initial step in the Kerberos authentication process?

The client sends a request to the service server for a service ticket.

The client sends a request to the Ticket Granting Service (TGS) for a service ticket.

The client sends a request to the Authentication Server (AS) for a Ticket Granting Ticket (TGT).

The client sends a request to the Key Distribution Center (KDC) for a session key.

The client sends a request to the Authentication Server (AS) for a Ticket Granting Ticket (TGT).

What information does the /etc/login.defs file contain in a Linux system?

Network configuration details

List of all installed software

User and group ID numbers

User account passwords

User and group ID numbers

You are a security architect for a large organization that uses various cloud services. The organization wants to implement a system that allows users to authenticate once and then access multiple applications, with the system providing information about the user to the applications. The system should be able to work across multiple platforms and authentication systems. Which solution would you recommend?

Network authentication

Local authentication

Password-based authentication

Claims-based identity

Claims-based identity

As a cybersecurity analyst, you are tasked with improving the security posture of your organization. You are considering the implementation of a Security Information and Event Management (SIEM) system. Which component of the SIEM system would be MOST critical for monitoring and securing network endpoints, services, and other vulnerable locations?Which of the following mechanisms can you use to add encryption to email? (Select two.)

Select the correct answer(s):

Reverse DNS

HTTPS

Secure Shell

PGP

S/MIME

Vulnerability scan output

Sensors

SIEM dashboards

Trends

Sensors

Which of the following mechanisms can you use to add encryption to email? (Select two.)

Select the correct answer(s):

Reverse DNS

HTTPS

Secure Shell

PGP

S/MIME

PGP

S/MIME

In a large healthcare organization, multiple departments handle sensitive patient data. Each department requires access to different applications and systems to carry out its tasks efficiently. However, granting broad access rights through long-lived authentication tokens poses security risks. What solution should the IT department implement while adhering to the principle of least privilege and securing sensitive patient data?

Multi-factor authentication (MFA)

Open Authorization (OAuth)

Kerberos

JSON web token (JWT)

Open Authorization (OAuth)

An employee named Bob Smith, whose username is bsmith, has left the company. You have been instructed to delete his user account and home directory. Which of the following commands would produce the required outcome? (Select two.)

Select the correct answer(s):

userdel bsmith;rm -rf /home/bsmith

userdel -Z bsmith

userdel bsmith

userdel -h bsmith

userdel -r bsmith

userdel bsmith;rm -rf /home/bsmith

userdel -r bsmith

If a user's BYOD device (such as a tablet or phone) is infected with malware, that malware can be spread if that user connects to your organization's network. One way to prevent this event is to use a network access control (NAC) system. How does an NAC protect your network from being infected by a BYOD device?

The NAC forces BYOD devices to connect to a guest network that is isolated from your production network.

The NAC specifies which apps can be used while the BYOD device is connected to the organization's network.

The NAC notifies users that personally owned devices are subject to random searches if brought on site.

The NAC remediates devices before allowing them to connect to your network.

The NAC remediates devices before allowing them to connect to your network.

You have a group named Research on your system that needs a new password because a member of the group has left the company. Which of the following commands should you use?

Select the correct answer:

newpasswd Research

groupmod -p Research

gpasswd Research

gpasswd research

gpasswd Research

The IT department of a medium-sized company is exploring various mobile solutions to improve productivity and enable employees to work efficiently on their mobile devices. They aim to choose a solution ensuring data security and seamless integration with the existing infrastructure. The team has narrowed the options to three potential mobile solutions: mobile device management (MDM), mobile application management (MAM), and corporate-owned personally enabled (COPE). Each solution offers different features and functionalities, and the IT team is assessing which one BEST meets the company's needs. Which mobile solution focuses on securing and managing the applications installed on employees' mobile devices rather than the devices themselves?

A combination of mobile device management (MDM) and mobile application management (MAM)

Mobile application management (MAM)

Corporate-owned personally enabled (COPE)

Mobile device management (MDM)

Mobile application management (MAM)

You have conducted a risk analysis to protect a key company asset. You identify the following values: Asset value = 400 Exposure factor = 75 Annualized rate of occurrence = .25 What is the single loss expectancy (SLE)?

Select the correct answer:

30000

300

100

475

The Single Loss Expectancy (SLE) is 300.

Calculation Breakdown

• Formula: SLE = Asset Value x Exposure Factor

• 400 x .75 = 300

Would you like to calculate the Annualized Loss Expectancy (ALE) next using the given occurrence rate?

An attacker has intercepted near-field communication (NFC) data and is using that information to masquerade as the original device. Which type of attack is being executed?

Select the correct answer:

Disassociation

Relay

Cloning

Bluesnarfing

Cloning

The leader of the cybersecurity team for a major e-commerce company recently encountered a major data breach that led to the exposure of customer payment details. The team has now contained the breach and is moving toward the final phase of the incident response cycle. What is the team's primary objective in this phase?

Analyze the incident and improve procedures or systems

Identify stakeholders and reporting requirements

Restore the affected system to a secure state

Eradicate the cause of the incident

Analyze the incident and improve procedures or systems

A cybersecurity analyst in a multinational corporation is responsible for sensitive customer data and proprietary information and is now dealing with a security breach. The team is managing the incident response process using the CompTIA incident response life cycle. The team has just completed the third step in the process. What must the team do next?

Select the correct answer:

Containment

Preparation

Analysis

Detection

Containment

A cybersecurity consultant is assessing risks for a new e-commerce website. The consultant identifies potential risks, evaluates their impact and likelihood, and considers the organization's ability to mitigate them. Which risk assessment methodology is the consultant MOST likely using?

Select the correct answer:

Qualitative and quantitative

Ad hoc

Qualitative

Quantitative

Qualitative

Upon running a security audit in your organization, you discover that several sales employees are using the same domain user account to log in and update the company's customer database. Which action should you take? (Select two. Each response is part of a complete solution.)

Select the correct answer(s):

Implement a Group Policy Object (GPO) that restricts simultaneous logins to one.

Delete the account that the sales employees are currently using.

Apply the Group Policy Object (GPO) to the container where the sales user accounts reside.

Implement a Group Policy Object (GPO) that implements time-of-day login restrictions.

Train sales employees to use their own user accounts to update the customer database.

Delete the account that the sales employees are currently using.

Train sales employees to use their own user accounts to update the customer database.

Which of the following utilities could you use to lock a user account? (Select two.)

answer

A

ulimit

B

usermod

C

userdel

D

useradd

E

passwd

passwd

usermod

One of your users, Karen Scott, has recently married and is now Karen Jones. She has requested that her username be changed from kscott to kjones with no other values changed.

Which of the following commands would accomplish this?

usermod -u kjones kscott

usermod -l kscott kjones

usermod -l kjones kscott

usermod -u kscott kjones

usermod -l kjones kscott

You have performed an audit and found an active account for an employee with the username joer. This user no longer works for the company.

Which command can you use to disable this account?

usermod -d joer

usermod -u joer

usermod -L joer

usermod -l joer

Correct Answer:Correct

usermod -L joer

Explanation

Use usermod -L joer to lock the user's password. Doing so disables the account.

The usermod -l joer command changes the account's login name.

The -d flag is used for changing the account's home directory.

The -u flag is used for changing the account's numeric ID.

You are a system administrator and you notice that a particular user's processes are consuming an unusually high amount of system resources, causing performance issues for other users.

You decide to use the ulimit command to limit the resources available to this user's processes.

Which of the following options would be the MOST effective solution and why?

Use the -t option to limit the amount of CPU time a process can use.

Use the -f option to limit the file size of files created using the shell session.

Use the -n option to limit the maximum number of files that the user can open.

Use the -u option to limit the number of concurrent processes the user can run.

Use the -t option to limit the amount of CPU time a process can use.

---

You are attempting to delete the temp group but are unable to.

Which of the following is the MOST likely cause?

Groups cannot be deleted.

All users have already been deleted.

The secondary group of an existing user cannot be deleted.

The primary group of an existing user cannot be deleted.

The primary group of an existing user cannot be deleted.

Which of the following commands is used to change the current group ID during a login session?

groups

newgrp

usermod

groupmod

newgrp

Which of the following are differences between RADIUS and TACACS+?

RADIUS supports more protocols than TACACS+.

RADIUS uses TCP; TACACS+ uses UDP.

RADIUS encrypts the entire packet contents; TACACS+ only encrypts the password.

RADIUS combines authentication and authorization into a single function; TACACS+ allows these services to be split between different servers.

RADIUS combines authentication and authorization into a single function; TACACS+ allows these services to be split between different servers.

A tech company is developing a new software product. The development team is distributed across different locations and needs to securely access and work on specific systems located in the company's main office.

The team members need to establish secure communication channels between their individual devices and the specific systems in the office.

Which remote access architecture would be the most suitable for this scenario

Client-to-site VPN technology

Virtual network computing (VNC)

Host-to-host tunnel topology

Site-to-site VPN topology

Explanation

Host-to-host tunnel topology is the correct answer. In a host-to-host tunnel topology, individual devices establish a secure tunnel between each other over a public network. This type of VPN is typically used for secure communication between specific hosts or endpoints, which is exactly what the team members need in this scenario.

Client-to-site VPN technology is typically used when individual users need to securely connect to a private network from a remote location. In this scenario, the team members need to establish secure communication channels with specific systems, not the entire network.

A site-to-site VPN topology is used to connect two or more geographically separate networks over a public network such as the Internet. This is typically used by businesses with multiple branch offices or organizations that must securely connect with external partners, not for secure communication between specific hosts or endpoints.

While VNC allows for remote control of another computer, it does not inherently provide the secure, encrypted tunnels needed for this scenario. VNC is a type of remote desktop software, not a remote access architecture. It would allow the team members to control the specific systems, but it would not provide the secure communication channels they need.

In a Kerberos authentication system, how does the Ticket Granting Service (TGS) contribute to the single sign-on (SSO) process

The TGS issues service tickets to clients for accessing specific services.

The TGS validates the client's password and username.

The TGS encrypts all data transferred between the client and the application server.

The TGS generates the initial Ticket Granting Ticket (TGT) for the client.

The TGS issues service tickets to clients for accessing specific services.

The initial Ticket Granting Ticket (TGT) is generated by the authentication service (AS), not the TGS.

A real estate investment firm wants to implement single sign-on (SSO) for its dozens of services and software. The firm found a vendor to implement that request using the eXtensible Markup Language (XML) standard.

What solution does this vendor use for SSO?

VPN

LDAP

LSASS

SAML

Explanation

Security Assertion Markup Language (SAML) allows for federating a network or cloud system. SAML assertions and claims between the principal, the relying party, and the identity provider use eXtensible Markup Language as their structure.

---

A company wants to set up single sign-on (SSO) without passing credentials through to each piece of software and cloud service.

Which protocol would meet this requirement?

Kerberos

FIDO

VPN

OAuth

The Open Authorization (OAuth) protocol is a system that facilitates sharing of information (resources) within a user profile between sites. The user can link that identity to an OAuth consumer site without giving the password to the consumer site.

An educational institution's systems administrator is responsible for securing the LDAP directory service for the organization's computing resources.

Which authentication method should the systems administrator implement to ensure secure access?

Simple Bind

No authentication

LDAP Secure (LDAPS)

Simple Authentication and Security Layer (SASL)

SASL allows the client and server to negotiate a supported authentication mechanism and provides the option to use the command STARTTLS for encryption and message integrity. This feature is a secure way to access the Lightweight Directory Access Protocol (LDAP) directory.

Enabling anonymous access (no authentication) to the directory is not secure, exposing it to potential misuse and unauthorized access.

In a simple bind, the client either binds anonymously, that is, with an empty bind DN, or by providing a DN and a password. This is not a secure method for LDAP.

LDAP Secure (LDAPS) uses TLS/SSL as a transmission protocol. However, this is not as secure as using SASL.

The security team in a financial organization identified a zero-day vulnerability attack that enables cross-site scripting (XSS) attacks on its internal web portal. The chief information security officer (CISO) instructs the team to take immediate action.

Which action MOST effectively minimizes the threat from the zero-day vulnerability and the potential XSS attacks?

Upgrade the hardware of the server.

Implement a web application firewall (WAF).

Restrict the number of login attempts.

Encourage staff to change their passwords.

Implement a web application firewall (WAF).

Which of the following are characteristics of a basic packet-filtering firewall? (Select two.)

Filters IP address and port

Stateful

Filters based on URL

Stateless

Filters based on sessions

Stateless/Filters IP address and port

A packet-filtering firewall makes decisions about which network traffic to allow by examining information in the IP packet header, such as source and destination addresses, ports, and service protocols. A packet-filtering firewall is considered a stateless firewall because it examines each packet and uses rules to accept or reject each packet without considering whether the packet is part of a valid and active session.

A circuit-level proxy or gateway makes decisions about which traffic to allow based on virtual circuits or sessions. A circuit-level proxy is considered a stateful firewall because it keeps track of the state of a session.

Application-level gateways filter on Application layer data, which might include data such as URLs within an HTTP request.

A cyber team implements new hardening techniques after a data loss prevention (DLP) audit revealed increased data exfiltration.

What is a tenet of host-based firewalls?

It provides controls for incoming and outgoing network traffic.

It uses signature-based detection and anomaly detection.

It describes software tools that monitor and protect individual hosts.

It requires deploying and configuring specialized software agents.

Explanation

Host-based firewalls provide controls for incoming and outgoing network traffic and are essential for detecting potential attacks. An important technique for using them when hardening endpoints involves implementing default-deny policies to block all traffic unless explicitly allowed.

Host-based intrusion prevention (HIPS) describes software tools that monitor and protect individual hosts, like computers or servers, from unauthorized access and malicious activities.

HIPS requires deploying and configuring specialized software agents to continuously monitor and analyze endpoints.

HIPS systems use signature-based detection, anomaly detection, and behavior analysis to identify suspicious activities. They also detect and actively respond to threats by automatically blocking or mitigating them.

Which of the following are features of an application-level gateway? (Select two.)

Verifies that packets are properly sequenced

Stops each packet at the firewall for inspection

Allows only valid packets within approved sessions

Uses access control lists

Reassembles entire messages

Stops each packet at the firewall for inspection

Reassembles entire messages

Application-level gateways:

• Operate up to OSL Layer 7 (Application layer)

• Stop each packet at the firewall for inspection (no IP forwarding)

• Inspect encrypted packets, such as an SSL inspection

• Examine the entire content that is sent (not just individual packets)

• Understand or interface with the application-layer protocol

• Can filter based on user, group, and data (such as URLs within an HTTP request)

• Is the slowest form of firewall protection because entire messages are reassembled at the Application layer

Allowing only valid packets within approved sessions and verifying that packets are properly sequenced are features of a stateful firewall.

Using access control lists is a feature of a packet-filtering firewall.

Which VPN protocol typically employs IPsec as its data encryption mechanism?

L2F

PPTP

L2TP

PPP

L2TP

L2TP (Layer 2 Tunneling Protocol) is the VPN protocol that typically employs IPsec as its data encryption mechanism. L2TP is the recommended VPN protocol to use on dial-up VPN connections.

PPTP and PPP only support CHAP and PAP for data encryption. L2F offers no data encryption.

Which of the following is commonly used in the first phase of Internet Key Exchange (IKE) negotiations for authenticating the identity of peers?

Biometrics

Passwords

Digital certificates

Security questions

Digital certificates

A network engineer has the task of creating a remote access solution for a global enterprise. The solution should secure encrypted communication for the company's employees worldwide and detect potential security threats in real time.

Which configuration should the network engineer deploy to meet these requirements?

A VPN utilizing IKE and IPSec protocols, combined with an inline intrusion detection system (IDS)

A network fortified by 802.1X port security, an Extensible Authentication Protocol (EAP), and a load balancer

A Software-Defined Wide Area Network (SD-WAN) with secure access service edge (SASE) implementation, supplemented by an intrusion prevention system (IPS)

A network equipped with a Next Generation Firewall (NGFW), a Web Application Firewall (WAF), and an intrusion prevention system (IPS) in tap/monitor mode

A VPN using internet key exchange and IPSec protocols secures remote access and communication. An inline IDS detects potential security threats in real time.

SD-WAN with SASE provides secure, scalable cloud-based network architecture but focuses more on optimization than secure remote access. An IPS prevents intrusions but doesn't directly address threat detection or secure remote access.

---

A salesperson in your organization spends most of her time traveling between customer sites. After a customer visit, she must complete various managerial tasks, such as updating your organization's order database.

Because she rarely comes back to your home office, she usually accesses the network from her notebook computer using Wi-Fi access provided by hotels, restaurants, and airports.

Many of these locations provide unencrypted public Wi-Fi access, and you are concerned that sensitive data could be exposed. To remedy this situation, you decide to configure her notebook to use a VPN when accessing the home network over an open wireless connection.

Which key steps should you take when implementing this configuration? (Select two.)

Configure the VPN connection to use PPTP

Configure the browser to send HTTPS requests through the VPN connection

Configure the VPN connection to use MS-CHAPv2

Configure the VPN connection to use IPsec

Configure the browser to send HTTPS requests directly to the Wi-Fi network without going through the VPN connection

Configure the VPN connection to use IPsec

Configure the browser to send HTTPS requests through the VPN connection

A large enterprise recently introduced a bring your own device (BYOD) policy and is seeing an uptick in the use of Internet of Things (IoT) devices in the office.

Concerns about unauthorized network access and compliance with security standards accompany these changes.

Assess the following options and determine the MOST suitable strategy to alleviate these security concerns.

Implement agentless Network Access Control (NAC) without firewall integration.

Deploy agent-based Network Access Control (NAC) with dynamic Virtual Local Area Networks (VLANs) and firewall integration.

Depend solely on the existing firewall for device authentication.

Use Network Access Control (NAC) without employing dynamic Virtual Local Area Networks (VLANs).

Explanation

An agent-based NAC approach combined with dynamic VLAN assignment and firewall integration provides a comprehensive solution. The solution offers robust device authentication, security policy compliance, and flexibility to accommodate various device types and user roles.

While agentless NAC can accommodate a variety of devices without prior configuration, its information about a device's status and compliance is less detailed than that of agent-based NAC.

Which of the following applies the appropriate policies in order to provide a device with the access it's defined to receive?

Identity Services Engine

Authorization

Authentication

Zero-trust security

Authorization

---

In a rapidly evolving IT environment, a cloud service provider offers various services to businesses, enabling them to store and process data securely. To enhance security, the provider regularly updates its systems and software.

Despite these efforts, a security researcher discovers a previously unknown vulnerability in one of the cloud-specific applications, leaving customer data exposed to potential threats.

In this scenario, which vulnerability is the security researcher likely to have found in the cloud-specific application?

SQL injection vulnerability

Network misconfiguration

Zero-day vulnerability

Cross-site scripting (XSS) vulnerability

Zero-day vulnerability

An attacker has obtained the logon credentials for a regular user on your network.

Which type of security threat exists if this user account is used to perform administrative functions?

Privilege escalation

Social engineering

Impersonation

Replay

Privilege escalation allows a user to take advantage of a software bug or design flaw in an application to gain access to system resources or additional privileges that are typically not available to normal users. Examples of privilege escalation include:

• A user accessing a system with a regular user account and successfully accessing functions reserved for higher-level user accounts (such as administrative features).

• A user who is able to access content that should be accessible only to a different user.

• A user who should have only administrative access being able to access content that should only be accessible to a regular user.

Privilege escalation does not occur when a user is able to steal or hack administrator credentials and is, therefore, able to access administrative functions. Privilege escalation refers to accessing features with an account that normally should not have access to those features.

You are implementing a new application control solution.

Prior to enforcing your application allow list, you want to monitor user traffic for a period of time to discover user behaviors and log violations for later review.

How should you configure the application control software to handle applications not contained in the allow list?

Block

Flag

Tarpit

Drop

Flag

When using an application control solution, an application allow list is defined centrally and applied to all network devices. Only applications contained in the allow list are allowed. Applications not allow listed can have several actions applied:

• Blocked applications are not allowed. The session is dropped if it uses UDP and reset if it uses TCP.

• Flagged applications are allowed, but a violation is logged when they are identified.

• Tarpitted applications are not allowed. However, the connection between hosts is kept alive while the application data itself is silently dropped. This makes it appear to both hosts that the other host is receiving the data but not responding.

Which of the following security actions represents a non-intrusive scanning type of framework?

Access control list (ACL)

Vulnerability scanning

Penetration testing

Keylogger

Vulnerability scanning

What do application control solutions use to identify specific applications?

Allow lists

Flags

Packet inspection

Application signatures

Application signatures

Which of the following are important practices in application vulnerability assessment to ensure the security of third-party software packages, libraries, and dependencies used within an organization? (Select two.)

SCA

SSL

SBOM

DHCP

VPN

• SBOM stands for Software Bill of Materials. It is a list of components in a piece of software. SBOMs contribute to software transparency and allow for the identification and management of open source components and third-party software dependencies, which in turn helps to identify known vulnerabilities and manage software supply chain risks.

• SCA stands for Software Composition Analysis. It is a method used to identify open source components and third-party software dependencies in a codebase, and to detect known vulnerabilities in them. By continuously comparing the organization's software inventory against various databases of known vulnerabilities, SCA tools can suggest updates or replacements for outdated packages or packages with known vulnerabilities.

A system administrator at a software development company is working on integrating package monitoring into the organization's vulnerability management strategy. The administrator aims to track software packages and applications to ensure they remain free from vulnerabilities and continue to support the firm's security framework.

As the system administrator incorporates package monitoring into the vulnerability management process, which actions will MOST likely get prioritized to enhance the effectiveness of this approach? (Select two)

Buying the latest antivirus software every month

Monitoring software repositories for new updates

Tracking outdated software packages

Manually updating software every day

Block firewall ports that are used by the software.

Monitoring software repositories for new updates

Tracking outdated software packages

Which of the following scenarios would typically utilize 802.1x authentication?

Authenticating remote access clients

Authenticating VPN users through the internet

Controlling access through a switch

Controlling access through a router

Explanation

802.1x authentication is an authentication method used on a LAN to allow or deny access based on a port or connection to the network. 802.1x is used for port authentication on switches and requires an authentication server for validating user credentials. This server is typically a RADIUS server.

Remote access authentication is handled by remote access servers or a combination of remote access servers and a RADIUS server for centralized authentication.

VPN connections can be controlled by remote access servers or by a special device called a VPN concentrator.

Standard ACL (routers)

Only filters traffic based on the source host name or host IP address

Extended ACLs

Can filter on a lot more, like source IP protocol, destination socket number, and destination host name or host IP address

Extended ACLs should be placed as close to the source as possible

Router security

• change factory defaults

• Use secure portocols (SSH, HTTPS, HTTP over SSL, SCP)

• Physical security

• Secure the config file and back up (use encryption)

• ACLs

• Segmentation

Configure anti-spoofing rules:

• Source: An IP address belonging to the internal network or the IP address of the router itself

• Destination: Any

• Service: Any

• Interface: Any external interface

• Direction: Inbound

• Action: Deny

• Time: Any

Deny Ping with ACLs

access-list 100 deny icmp host 10.0.0.2 0.0.0.0 255.255.255.255 (0.0.0.0 = anything)

---

You've just deployed a new Cisco router that connects several network segments in your organization.

The router is physically located in a locked server closet. You use an FTP client to regularly back up the router configuration to a remote server in an encrypted file. You access the router configuration interface from a notebook computer that is connected to the router's console port. You've configured the device with the username admin01 and the password P@ssW0rd. You have used the MD5 hashing algorithm to protect the password.

What should you do to increase the security of this device?

Move the router to a secure data center.

Use an SSH client to access the router configuration.

Use encrypted Type 7 passwords.

Use SCP to back up the router configuration to a remote location.

Use SCP to back up the router configuration to a remote location.

In this scenario, the router configuration is being copied to a remote location using an unsecure protocol (File Transfer Protocol) that transfers data in cleartext. You should instead use the Secure Copy Protocol (SCP) to transfer the backup from the router to the remote storage location.

It is not necessary to use an SSH client when using the console port to configure the router.

It is also not necessary to move the device to a data center if it is currently located in a locked server closet.

Encrypted Type 7 passwords on a Cisco device are less secure than those protected with MD5.

A critical infrastructure organization responsible for managing energy distribution across a large region relies heavily on industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems to monitor and control the power grid.

Given the critical nature of the operations, the IT team has implemented a unique control to safeguard these systems.

Which unique control did the IT team use to protect ICS and SCADA systems?

Regular system updates

Secure boot mechanisms

Transport encryption protocols

Network segmentation

Secure boot mechanisms

Which of the following happens by default when you create and apply a new ACL on a router?

ACLs are not created on a router.

The ACL is ignored until applied.

All traffic is permitted.

All traffic is blocked.

All traffic is blocked.

When first created and applied on a router, an ACL almost always includes a hidden Deny Any statement at the end of the list. This means all traffic is automatically blocked.

All traffic is not permitted by default with a new ACL.

The ACL is immediately applied and blocks all traffic until configured.

ACLs are created on the router itself.

---

Which kind of access control technology allows more than just the identity of an individual to be transmitted wirelessly to either allow or deny access?

Keypad locks

Proximity card

Smart card

Biometric locks

Unlike proximity cards that only transmit the owner's identity, smart cards can contain and transmit many more pieces of information.

---

As the head of physical security at a large tech company, you have been tasked with investigating a series of unauthorized entries into secure areas of your facilities.

The intrusions have been sporadic and seemingly random, with no clear pattern or motive. The intruders have not been caught on camera, and no physical damage or theft has been reported. However, you notice that the access logs show entries made using the credentials of employees who were not on-site at the time of the incidents.

Which of the following is the MOST likely method the intruders are using to gain access?

Bypassing CCTV cameras

RFID cloning

Social engineering

Lock picking

RFID cloning

You want to use CCTV to increase your physical security, and you want the ability to remotely control the camera position.

Which camera type should you choose?

Dome

C-mount

PTZ

PTZ (Pan Tilt Zoom)

A Pan Tilt Zoom (PTZ) camera lets you dynamically move the camera and zoom in on specific areas (cameras without PTZ capabilities are set looking a specific direction). Automatic PTZ mode automatically moves the camera between several preset locations. Manual PTZ lets an operator remotely control the position of the camera.

A bullet camera has a built-in lens and is long and round in shape. Most bullet cameras can be used indoors or outdoors. A c-mount camera has interchangeable lenses, is typically rectangular in shape, and carries the lens on its end. Most c-mount cameras require special housing to be used outdoors. A dome camera is a camera protected with a plastic or glass dome. These cameras are more vandal-resistant than other cameras.

Bullet, c-mount, or dome cameras can also be PTZ cameras.

Which type of reconnaissance is associated with dumpster diving?

Passive

Active

OSINT

Packet sniffing

Passive, as it has no direct interacting with the target

OVAL

Open Vulnerability and Assessment Language (OVAL) is an international standard for testing, analyzing, and reporting the security vulnerabilities of a system.

Signature based detection

Aka pattern matching, dictoinary recognition, or misuse-detection (MD-IDS). Looks for patterns in network traffic and compares known attack patterns (signatures)

Heuristic-based detection

Behavior/anomaly/statistical-based detection. First defines a baseline of normal network traffic, then monitors traffic for anything outside of it

---

A multinational corporation has recently implemented an intrusion detection system (IDS) and intrusion prevention system (IPS) to protect its network infrastructure.

The security team receives many alerts and struggles to manage false positives. The team must optimize the IDS and IPS to identify and prioritize actual threats while minimizing irrelevant alerts.

Which primary strategy should the team adopt to achieve this objective?

Integrate SELinux policies for a layered security approach, ensuring system-level restrictions to applications and processes.

Apply signature-based detection rules only to filter out false positives.

Ignore all alerts from the IDS/IPS to focus on manual monitoring of network traffic.

Implement trend analysis to identify patterns and anomalies, tune the IDS/IPS over time, and prioritize genuine threats.

Implement trend analysis to identify patterns and anomalies, tune the IDS/IPS over time, and prioritize genuine threats.

An active IDS system often performs which of the following actions? (Select two.)

Traps and delays the intruder until the authorities arrive.

Requests a second logon test for users performing abnormal activities.

Performs reverse lookups to identify an intruder.

Cannot be detected on the network because it takes no detectable actions.

Updates filters to block suspect traffic.

Updates filters to block suspect traffic.

Performs reverse lookups to identify an intruder.

As a security precaution, you have implemented IPsec that is used between any two devices on your network. IPsec provides encryption for traffic between devices.

You would like to implement a solution that can scan the contents of the encrypted traffic to prevent any malicious attacks.

Which solution should you implement?

Port scanner

Network-based IDS

Protocol analyzer

Host-based IDS

VPN concentrator

A host-based IDS is installed on a single host and monitors all traffic coming into the host. A host-based IDS can analyze encrypted traffic because the host operating system decrypts that traffic as it is received.

Protocol analyzers cant read encrypted traffic

You are the lead cybersecurity analyst for a multinational corporation. Your team has recently completed a vulnerability analysis of the company's IT infrastructure.

The CEO has requested a briefing on the most critical consideration that should guide the company's remediation efforts.

Which of the following considerations should you emphasize in your briefing?

Risk tolerance

Classification

Prioritization

Exposure factor

Exposure factor

Explanation

Exposure factor is the correct answer. The exposure factor represents the extent to which an asset is susceptible to being compromised or impacted by a specific vulnerability. It considers the accessibility of a vulnerable system or data and environmental factors like the current threat landscape or the specifics of the organization's IT infrastructure. These factors significantly influence the likelihood of a vulnerability being exploited and directly impact its overall risk level. Therefore, understanding the exposure factor is crucial in guiding remediation efforts.

While prioritization is an important aspect of vulnerability analysis, it is not the most critical consideration. Prioritization helps to identify the most critical vulnerabilities based on factors such as severity, ease of exploitation, and potential impact. However, without considering the exposure factor, prioritization might not accurately reflect the actual risk to the organization.

As a cybersecurity analyst, you are tasked with improving the security of your organization's software applications. One of your responsibilities is to ensure that all third-party software packages, libraries, and dependencies used within your organization are up-to-date and free from known vulnerabilities.

Which of the following would be the MOST effective tool for accomplishing this task?

Intrusion detection system (IDS)

Software Bill of Materials (SBOM)

National Vulnerability Database (NVD)

Software composition analysis (SCA)

Software Bill of Materials (SBOM)

A Software Bill of Materials (SBOM) is a comprehensive list of components in a piece of software. It provides detailed information about each component, including its source, version number, and any known vulnerabilities. This makes it an effective tool for tracking and assessing the security of third-party software packages, libraries, and dependencies.

As a cybersecurity analyst, you are tasked with identifying known vulnerabilities in the third-party software packages, libraries, and dependencies used within your organization.

Which of the following would be the MOST effective tool for accomplishing this task?

Intrusion detection system (IDS)

National Vulnerability Database (NVD)

Software Bill of Materials (SBOM)

Software composition analysis (SCA)

The National Vulnerability Database (NVD) is a U.S. government repository of standards-based vulnerability management data. It includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics. It is the most effective tool for identifying known vulnerabilities in third-party software packages, libraries, and dependencies.

Which of the following security orchestration, automation, and response (SOAR) system automation components is often used to document the processes and procedures that are to be used by a human during a manual intervention?

Playbook

Orchestration

Runbook

Response

Playbooks are linear checklists of required steps and actions that are to be taken to respond to an alert. While playbooks do support automated actions, they are often used to document the processes and procedures that are to be used by a human during a manual intervention.

Runbooks consist of a series of conditional steps to perform actions, such as sending notifications or threat containment. They are not used to document the processes and procedures that are to be used by a human during a manual intervention.

---

Which SIEM component is responsible for gathering all event logs from configured devices and securely sending them to the SIEM system?

Collectors

Security automation

SIEM alerts

Data handling

Collectors

A manufacturing company's security manager plans to implement corrective operational controls to mitigate potential security threats.

Which of the following instances would be the appropriate control?

Enabling continuous monitoring to disable abnormal accounts.

Regular penetration testing to uncover potential vulnerabilities.

A security camera system monitoring the premises.

A firewall that prevents unauthorized access to the network.

Explanation

Enabling continuous monitoring to disable abnormal accounts is a corrective operational control. When detecting abnormal behavior, this control disables the account to prevent unauthorized access.

Penetration testing is more of a detective control than a corrective one. It identifies vulnerabilities but does not correct them directly.

A firewall is primarily a preventive control, not a corrective one. Its main function is to stop unauthorized access before it happens rather than correcting issues after they occur.

Security cameras are typically a deterrent and detective type of physical control, not an operational one. They can deter potential intruders and detect security incidents, but they do not correct issues directly

A cybersecurity team at an organization prepares to carry out an assessment that aims to mimic potential attackers' tactics, techniques, and procedures (TTPs) to identify vulnerabilities and weaknesses in the organization's digital systems.

What type of penetration test is the team about to conduct?

Integrated penetration testing

Defensive penetration testing

Physical penetration testing

Offensive penetration testing

Offensive penetration testing is a proactive and controlled approach to simulate real-world cyberattacks on an organization's systems, networks, and applications to identify vulnerabilities, weaknesses, and potential attack vectors that malicious actors could exploit.

Defensive penetration testing evaluates an organization's overall resilience against cyber threats, not actively trying to find vulnerabilities as an attacker might.

Physical penetration testing involves assessing an organization's physical security practices and controls, such as access controls, surveillance, and perimeter defenses.

While integrated penetration testing can include offensive penetration testing, the scenario specifically describes an offensive penetration test.

You have been promoted to team lead of one of the security operations teams.

Which security team are you now a part of?

White

Re

Purple

Blue

The white team members are the referees of cybersecurity. This team is responsible for managing the engagement between the red and blue teams. This group typically consists of the managers or team leads.

KRI

Key Risked Indicator

A risk manager at a large corporation conducts a risk and control self-assessment (RCSA) to identify and assess risks for a new market expansion. The manager identifies risks associated with new regulatory requirements, market volatility, and aggressive competitors. Which key risk indicator (KRI) metric is MOST critical for managing these risks?

The level of market volatility.

The frequency of security incidents involving sensitive customer data.

The number of new customers acquired in the new market.

The number of regulatory violations reported by the regulatory authority.

The number of regulatory violations reported by the regulatory authority.

You are the IT Security Manager at a large corporation. The company has just acquired a batch of new servers that will be used to host critical applications.

As part of the company's OS hardening policy, you are tasked with ensuring these servers are secure before they are deployed.

What should be your first step?

Enforce a strict password policy for all users who will have access to the servers.

Connect the servers to the network to monitor for any potential security threats.

Apply a configuration baseline template to the servers to ensure they are configured according to industry security standards.

Install the latest antivirus software on the servers.

Apply a configuration baseline template to the servers to ensure they are configured according to industry security standards.

Which of the following tools can you use on a Windows network to automatically distribute and install software and operating system patches on workstations? (Select two.)

WSUS

Security Configuration and Analysis

Security Templates

Configuration baseline

Group Policy

Group Policy

WSUS

You want to close all ports associated with NetBIOS on your network's firewalls to prevent attacks directed against NetBIOS.

Which ports should you close?

135, 137-139

389, 636

67, 68

161, 162

NetBIOS uses the following ports:

• TCP 135

• TCP and UDP 137

• TCP and UDP 138

• TCP 139

You are a system administrator for a Linux server. You have a directory named "project," which contains sensitive data. The directory is currently accessible to everyone in your team.

You need to change the permissions so that only you (the owner) can read, write, and execute, while your team (the group) can only read and execute. Other users should not have any access.

Which of the following commands should you use?

chmod 750 project

chmod 700 project

chmod 777 project

chmod 755 project

Use Answer A: chmod 750 project. [1]

Permission Breakdown

• 7 (Owner): Read (4) + Write (2) + Execute (1) = Full access.

• 5 (Group): Read (4) + Execute (1) = Read and execute only.

• 0 (Others): No permissions (0) = No access

You want to make sure no unneeded software packages are running on your Linux server.

yum list installed

You need to increase the security of your Linux system by finding and closing open ports.

Which of the following commands should you use to locate open ports?

nslookup

netstat

traceroute

nmap

nmap

---

Which of the following types of site surveys should be performed first?

Passive

Ad hoc

Active

Predictive

Passive

An initial site survey performed should be a passive survey. This survey is performed without the analyzer connecting to any specific WAP and is in a listen-only mode.

An active survey is performed after multiple passive surveys have been completed and the wireless access points have been placed. An active survey verifies proper coverage has been achieved.

A predictive survey uses software programs to load the building blueprints and determine where to install the WAPs.

An ad hoc wireless configuration mode provides wireless communication without a wireless access point. Ad hoc mode is not a type of site survey.

You are a network security consultant for a small business that is setting up a new wireless network. The business owner is concerned about the security of the network, especially in terms of protecting against unauthorized access.

The owner is not technically savvy and wants a solution that is secure but also user-friendly.

Which of the following authentication methods would you recommend?

Extensible Authentication Protocol (EAP)

Pre-shared key (PSK)

Password-Authenticated Key Exchange (PAKE)

Open System Authentication

Password-Authenticated Key Exchange (PAKE)

It is a method that allows users to establish a secure communication channel by using a password. It provides a good balance between security and user-friendliness. Even if an attacker intercepts the password, they cannot use it to derive the encryption key. This makes PAKE a good choice for a small business owner who wants a secure but user-friendly authentication method.

You want to implement 802.1x authentication on your wireless network.

Where would you configure passwords that are used for authentication?

On a RADIUS server

On the wireless access point

On a certificate authority (CA)

On the wireless access point and on each wireless device

On a RADIUS server

---

When using SSL authentication, what does the client verify first when checking a server's identity?

Master secrets are verifiable from asymmetric keys.

The certificate must be non-expiring and self-signed by the sysadmin.

All DNS resolutions must point to the corporate intranet routers.

The current date and time must fall within the server's certificate-validity period.

The current date and time must fall within the server's certificate-validity period.

An SSL client first checks the server's certificate validity period. The authentication process stops if the current date and time fall outside of the validity period.

SSL clients verify a server's identity using the following steps:

1. The client checks the server's certificate validity period. The authentication process stops if the current date and time fall outside of the validity period.

2. The client verifies that the issuing certificate authority (CA) is on its list of trusted CAs.

3. The client uses the CA's public key to validate the CA's digital signature on the server certificate. If the digital signature can be verified, the client accepts the server certificate as a valid certificate issued by a trusted CA.

4. To protect against man-in-the-middle attacks, the client compares the actual DNS name of the server to the DNS name on the certificate.

Which of the following protocols can TLS use for key exchange? (Select two.)

RSA

IKE

ECC

KEA

Diffie-Hellman

Diffie-Hellman

RSA

---

You are a network administrator tasked with implementing IPsec to secure data transmission over the company's unprotected TCP/IP network.

You decide to use the Encapsulating Security Payload (ESP) protocol for its confidentiality feature. However, you are unsure whether to use transport mode or tunnel mode. The company's network includes several routers and switches, and it also uses Network Address Translation (NAT).

Which mode should you choose and why?

Transport mode because it only encrypts the payload, making it faster and more efficient.

Transport mode because it is more compatible with NAT.

Tunnel mode because it is more compatible with NAT.

Tunnel mode because it encrypts the entire packet, providing an extra layer of security.

Tunnel mode because it is more compatible with NAT.

Tunnel mode is the correct choice because it is more compatible with NAT. In tunnel mode, the entire original IP packet (including the header) is encrypted and encapsulated into a new packet. This allows the packet to traverse through NAT devices without the NAT modifications causing issues, as the modifications are made to the outer packet, not the encrypted original packet.

A software development company has implemented an IPsec tunnel with Internet Key Exchange (IKE) for mutual authentication as part of its Virtual Private Network (VPN) setup for employees.

The company chooses this solution for its ability to encrypt network connections at the packet level and support mutual authentication with low packet overhead.

What benefits do the IT department likely aim to achieve with this setup?

Reliability of an established legacy protocol

Mutual authentication using SSL

Protection at the packet level with mutual authentication

Secure application-level connections

Protection at the packet level with mutual authentication

Internet Protocol Security (IPsec) operates at the network layer, protecting secure VPN connections at the packet level. It also uses Internet Key Exchange (IKE) to perform mutual authentication, which aligns with the team's requirements.

The chosen setup does not likely benefit from using Transportation Layer Security (TLS) tunnels to secure application-level connections between two applications.

IPsec can utilize Secure Sockets Layer (SSL) through IKEv2, but it typically establishes mutual authentication and does not use SSL for that purpose.

A cybersecurity analyst is trying to discover why a web application's interpreter executes unintended commands. The analyst notices that the attack involves sending untrusted data to an interpreter as part of a command or query.

What does the analyst suspect is happening?

Injection attack

Replay attack

DDoS attack

On-path attack

Injection attacks involve sending untrusted data to an interpreter as part of a command or query. This data tricks the interpreter into executing unintended commands, potentially allowing unauthorized access or data retrieval.

You are a security analyst for a large e-commerce company. You notice that a significant number of users are complaining about unauthorized transactions on their accounts.

After investigating, you suspect that the site might be a victim of a Cross-Site Request Forgery (CSRF) attack.

Which of the following actions should you take next?

Advise users to change their passwords immediately.

Ignore the complaints as false positives since the transactions are coming from the users' IP addresses.

Implement CAPTCHA on all transaction pages to prevent automated attacks.

Implement a CSRF token in your web application's forms.

Implementing a CSRF token in your web application's forms is a common and effective defense against CSRF attacks and is the correct answer. The token is a random value associated with the user's session and is included in every form submission. If the token in the form doesn't match the token on the server, the request is rejected.vgbh

You are a cybersecurity analyst at a large corporation. One of your responsibilities is to ensure that employees are following best practices for enhancing browser privacy.

You notice that one department is experiencing a higher than usual number of security incidents related to their web browsing habits.

What is the MOST effective action to take to enhance browser privacy and reduce these incidents?

Clear the web browser cache regularly.

Restrict the use of cookies.

Enforce the use of incognito mode.

Disable all browser add-ons.

Restricting the use of cookies is the correct answer. Cookies are text files that save information about preferences, browser settings, and web page preferences. They can be used by websites to track user activity and can potentially be misused by hackers to collect and report your web surfing activities. Restricting the use of cookies can significantly enhance browser privacy and reduce security incidents.