1. You run vulnerability scans of several critical hosts. You expected many vulnerabilities to show up from the scans, but the scan results show very little data, and the data that is produced is generic and is not very detailed. Which of the following is the most likely reason for these results?

2. You are a vulnerability analyst for a large hospital chain. You wish to perform a vulnerability scan on all the laptops used by doctors to conform to HIPAA's risk analysis requirements. However, certain doctors are off-site with their laptops and therefore disconnected from the hospital network. Which of the following is the best solution for scanning disconnected physician laptops?

3. You are in charge of managing your company's cloud service provider contract. Lately, there have been reports that sensitive data has been exfiltrated from the organization and published on the open Internet. This seems strange to you because no sensitive data is stored on company servers; it is all stored in the cloud provider's secure data center. Collaborating with the cloud service provider's security team, you should look at which of the following first to determine if there any security issues that may have resulted in unauthorized data access?

4. Evie is a cybersecurity analyst who works at a major research facility. While performing a routine audit of user access, she discovers that someone has been repeatedly trying the same set of ten passwords across various usernames and accounts within the organization. Which of the following types of attack has she discovered?

5. Adam is a risk manager for a major financial services company. Having recently collected a set of high-risk threat data from the threat intelligence sharing community, Adam responded by implementing a new intrusion prevention system (IPS) device. In which of the following NIST Risk Management Framework phases does his executive leadership determine that the IPS has provided adequate security protections to the organization?

6. José is a cybersecurity analyst tasked with improving the physical access controls in an aging production facility. He would like to be able to automate building entry, review audit logs of who entered restricted areas, and be able to grant specific access to restricted areas for certain individuals. Currently, there is no system in place to accomplish those objectives, and individuals must each have an old-fashioned brass key to unlock a heavy, manual steel door to enter a restricted area. Which of the following would be an ideal solution for José to implement?

7. Emilia is a cybersecurity analyst with an application programming background. She has been tasked to work with some of the company's web application programmers to ensure that they are considering security in their programming logic. During application security tests, Emilia discovers that she can input statements into a username field that will return a list of users from the application's back-end database. Emilia has discovered that the web application is vulnerable to which of the following types of attack?

8. Robin is a cybersecurity analyst who works at a major research facility. The researchers there are collaborating with several other large think tanks and universities on a significant economic research study and must share data and resources, including computing power and storage. The research facility manager has directed Robin to move the researchers' work into a cloud configuration so they can collaborate more easily with their counterparts in other organizations. Which of the following would be an appropriate cloud deployment model for this project?

9. Tom is performing a routine vulnerability scan on the company network. He just updated the organization's subscription to Nessus and altered several preconfigured scan options. Once he completed the scan, he noticed that the scan results yielded little information back from most of the hosts on the network. Tom knows that he should have gotten back a great deal more information from the scan. Which of the following could have contributed to this issue?

10. Sarah is a cybersecurity specialist who works at Stark Industries. Recent threat intelligence, corroborated from multiple open-source intelligence resources, suggests that a new wave of “mutating” malware has been reported by other organizations in the industry. Sarah is concerned that this malware will escape traditional antimalware detection techniques. Which of the following techniques should she implement to best mitigate the concern?

11. Ben is a threat intelligence analyst. The DevOps team is developing an application designed to remotely control unmanned aircraft. Ben wants the application development team to incorporate a threat model to ensure security objectives are integrated into the application development lifecycle from the start. Which of the following threat models was created by Microsoft to ensure developers incorporate security into application development?

12. Taylor is part of the security team hardening automation systems in a military-grade UAV system. Which of the following is not a concern when designing cybersecurity for the drone's internal computer systems?

13. Alberto is a cybersecurity analyst who works for a major power company. He's trying to improve the security of some of the older SCADA systems the power company uses to monitor and control power fluctuations. Which of the following protocols will he most likely encounter in his system configuration upgrades?

14. You are an IT security analyst working as a consultant for another company. You have almost completed upgrades from Windows 7 to the latest Windows 10 operating system (OS). You know that the Windows 7 'Extended Support' period ended on January 14, 2020. After that date, Microsoft no longer creates and distributes OS patches for Windows 7. Which of the following threats is Windows 7 now increasingly subjected to?

15. You're a cybersecurity analyst who works for a large financial organization based in the U.S. Your manager asks you how cybercriminals collect information about their targets during the early stages of an attack. Which of the following methods would you discuss with your manager?

16. Sam is a programmer who is writing a web-based application for his company. One of the cybersecurity analysts in his organization has just tested the prototype for the application and discovered several security flaws that must be corrected. One flaw, in particular, is associated with thread and process timing and causes issues because two processes are trying to concurrently access the same object, and the resulting conflict allows an attacker to execute arbitrary code. Which of the following software flaws has the analyst discovered?

17. Sam is a cybersecurity analyst who works in a security operations center (SOC) at Rogers Enterprises. Part of his duties involves implementing attack frameworks to better understand how adversarial behaviors operate before, during, and after cyber attacks. Which of the following is the correct order of attack phases in the Lockheed Martin Cyber Kill Chain he should use when analyzing a threat?

18. Bobby is a cybersecurity analyst who works at a major university. He routinely must assess the university's wireless network for vulnerabilities. He has been tasked with determining if there are easy-to-guess passwords for the wireless network. Which of the following tools might he use to intercept wireless passwords and attempt to crack them?

19. Rhonda is a cybersecurity analyst who works for an automotive manufacturer. She's helping to design a next-generation vehicle automation system and wants to ensure that security is designed throughout the system. Which of the following improvements should she make to existing vehicle automation system design?

20. You are a cybersecurity analyst who keeps receiving phone calls from internal customers stating that they can only access sensitive data files on an intermittent basis. Upon further examination, you determine that all of the inaccessible data stores are cloud-based. You begin to troubleshoot the issue and look for potential causes, including faulty permissions and authentication issues. Regardless of what's causing the data to be inaccessible, what is the key issue here?

21. Dawn is a cybersecurity analyst who works in a security operations center. Part of her duties involve routinely scanning for vulnerabilities in the organization's infrastructure. She was recently tasked with analyzing code for a web application that will be implemented soon on the organization's web servers. Dawn needs to review the code using a variety of methods, but more importantly, she needs to know about the security issues that might occur while the code is executing. Which of the following would be the best method for achieving this?

22. Ash has been put in charge of migrating the organization's application infrastructure to the cloud. The organization is contemplating a subscription model where lines of business and desktop applications are accessible over a web-based interface. The organization wants to move the responsibility of keeping the applications updated to the cloud provider. Which of the following service models should Ash consider?

23. Barbara has been authorized to conduct a security assessment on her organization's AWS cloud infrastructure. In addition to ordinary vulnerability scanning, she has been authorized to perform penetration tests on the infrastructure. Which of the following tools would be best suited for this task?

24. Dawn is a cybersecurity analyst who works for a large corporation. Through her vulnerability research, she's discovered a “High” risk vulnerability with Microsoft Exchange Server. Which of the following resources should she access to discover the CVSS Base Score for this vulnerability?

25. Working as a vulnerability analyst for your organization, you've completed a vulnerability scan of all Windows 10 desktop and laptop computers. Although your scan did not discover any new Windows 10 vulnerabilities, you recall reading about a brand-new Windows 10 vulnerability that was posted on a vulnerability feed just yesterday. Working backward, you determined that both your vulnerability scanner and Windows 10 received all available updates today. Which of the following vulnerability validations has occurred?