Which of the following should a security administrator adhere to when setting up a new set of
firewall rules?
A. Disaster recovery plan
B. Incident response procedure
C. Business continuity plan
D. Change management procedure
A technician needs to apply a high-priority patch to a production system. Which of the following
steps should be taken first?
A. Air gap the system.
B. Move the system to a different network segment.
C. Create a change control request.
D. Apply the patch to the system.
Which of the following best practices gives administrators a set period to perform changes to an
operational system to ensure availability and minimize business impacts?
A. Impact analysis
B. Scheduled downtime
C. Backout plan
D. Change management boards
A systems administrator would like to deploy a change to a production system. Which of the
following must the administrator submit to demonstrate that the system can be restored to a
working state in the event of a performance issue?
A. Backout plan
B. Impact analysis
C. Test procedure
D. Approval procedure
The management team notices that new accounts that are set up manually do not always have
correct access or permissions.
Which of the following automation techniques should a systems administrator use to streamline
account creation?
A. Guard rail script
B. Ticketing workflow
C. Escalation script
D. User provisioning script
Which of the following is the best way to consistently determine on a daily basis whether security
settings on servers have been modified?
A. Automation
B. Compliance checklist
C. Attestation
D. Manual audit
A systems administrator is creating a script that would save time and prevent human error when
performing account creation for a large number of end users. Which of the following would be a
good use case for this task?
A. Off-the-shelf software
B. Orchestration
C. Baseline
D. Policy enforcement
Which of the following most impacts an administrator's ability to address CVEs discovered on a
server?
A. Rescanning requirements
B. Patch availability
C. Organizational impact
D. Risk tolerance
Which of the following tasks is typically included in the BIA process?
A. Estimating the recovery time of systems
B. Identifying the communication strategy
C. Evaluating the risk management plan
D. Establishing the backup and recovery procedures
E. Developing the incident response plan
A company purchased cyber insurance to address items listed on the risk register. Which of the
following strategies does this represent?
A.Accept
B. Transfer
C. Mitigate
D. Avoid
Which of the following is the most likely to be used to document risks, responsible parties, and
thresholds?
A. Risk tolerance
B. Risk transfer
C. Risk register
D. Risk analysis
Which of the following provides the details about the terms of a test with a third-party penetration
tester?
A. Rules of engagement
B. Supply chain analysis
C. Right to audit clause
D. Due diligence
A penetration tester begins an engagement by performing port and service scans against the client
environment according to the rules of engagement. Which of the following reconnaissance types is
the tester performing?
A. Active
B. Passive
C. Defensive
D. Offensive
Which of the following security control types does an acceptable use policy best represent?
A. Detective
B. Compensating
C. Corrective
D. Preventive
Which of the following agreement types defines the time frame in which a vendor needs to respond?
A. SOW
B. SLA
C. MOA
D. MOU
A client demands at least 99.99% uptime from a service provider's hosted security services. Which of
the following documents includes the information the service provider should return to the client?
A. MOA
B. SOW
C. MOU
D. SLA
A company is working with a vendor to perform a penetration test Which of the following includes an
estimate about the number of hours required to complete the engagement?
A. SOW
B. BPA
C. SLA
D. NDA
Which of the following is the best reason to complete an audit in a banking environment?
A. Regulatory requirement
B. Organizational change
C. Self-assessment requirement
D. Service-level requirement
Which of the following is the most likely outcome if a large bank fails an internal PCI DSS compliance
assessment?
A. Fines
B. Audit findings
C. Sanctions
D. Reputation damage
An organization wants a third-party vendor to do a penetration test that targets a specific device. The
organization has provided basic information about the device. Which of the following best describes
this kind of penetration test?
A. Partially known environment
B. Unknown environment
C. Integrated
D. Known environment
Which of the following penetration testing teams is focused only on trying to compromise an
organization using an attacker's tactics?
A. White
B. Red
C. Purple
D. Blue
