104. Various devices are connecting and authenticating to a single evil twin within the network. Which of the following are MOST likely being targeted? A. Mobile devices B. All endpoints C. VPNs D. Network infrastructure E. Wired SCADA devices My guess: D Others answer: A __________________________________________________ 107. A security analyst is attempting to configure a vulnerability scan for a new segment on the network. Given the requirement to prevent credentials from traversing the network while still conducting a credentialed scan, which of the following is the BEST choice? A. Install agents on the endpoints to perform the scan B. Provide each endpoint with vulnerability scanner credentials C. Encrypt all of the traffic between the scanner and the endpoint D. Deploy scanners with administrator privileges on each endpoint My guess: A Others answer: A __________________________________________________ Which of the following are essential components within the rules of engagement for a penetration test? (Select TWO). A. Schedule B. Authorization C. List of system administrators D. Payment terms E. Business justification My guess: A & B Others answer: A & B __________________________________________________ 116. A security analyst is conducting traffic analysis and observes an HTTP POST to the company's main web server. The POST header is approximately 1000 bytes in length. During transmission, one byte is delivered every ten seconds. Which of the following attacks is the traffic indicative of? A. Exfiltration B. DoS C. Buffer overflow D. SQL injection My guess: A, B Others answer: A __________________________________________________ 130. The security operations team is conducting a mock forensics investigation. Which of the following should be the FIRST action taken after seizing a compromised workstation? A. Activate the escalation checklist B. Implement the incident response plan C. Analyze the forensic image D. Perform evidence acquisition My guess: D Others answer: B __________________________________________________ 146. An organization is experiencing degradation of critical services and availability of critical external resources. Which of the following can be used to investigate the issue? A. Netflow analysis B. Behavioral analysis C. Vulnerability analysis D. Risk analysis My guess: A Others answer: C