QUESTION 101
A customer wants to implement a phone ordering mechanism for employees s that triggers a notification for the requester and approver at each approval level. Which feature is used to achieve this?

A. Approval Criteria
B. Parent-Child Approvers
C. Approver Delegates
D. Flows and Subflows

Correct Answer: D

QUESTION 102
How would you describe the relationship between the Incident and Task table?

A. Incident table has a one to many relationship with the Task table
B. Incident table is related to the Task table via the INC number
C. Incident table has a many to many relationship with the Task table
D. Incident table is a database view of the Task table
E. Incident table is extended from Task table

Correct Answer: E

QUESTION 103
Which of the following cryptographic techniques is the most resistant to quantum computing decryption attacks?

A. Elliptic curve
B. Zero-knowledge proofs
C. Lattice-based
D. AEAD

Correct Answer: C

QUESTION 104
An engineer is distributing sensitive material to staff members. The material is stored on removable media, and staff members must manually load the material onto devices at field sites. The engineer verifies the identity of staff members receiving this material and would like to provide an additional layer of protection should the removable media be lost or stolen. Which of the following is the best way to meet this objective?

A. Issuing OTPs that are unique to each instance provided
B. Computing a non-reversible hash of the sensitive files on the disk
C. Tokenizing sensitive data on the removable media
D. Injecting the sensitive material into the headers of files on the disk

Correct Answer: C

QUESTION 105
A security engineer is reviewing logs and summarizes the following:
1. The target host communicates to an external IP address over HTTPS.
2. The external IP address was not categorized as malicious.
3. The company has a deep packet inspection system that supports HTTPS traffic.
4. The attack uses a known command-and-control tool to beacon from an affected host.

Which of the following techniques did the attacker most likely use?

A. Redirection
B. Custom BOF
C. EDR evasion
D. Steganography

Correct Answer: D

QUESTION 106
A Chief Information Security Officer receives the following findings from a third-party risk assessment report:
Finding #1: Absence of a risk management process
Finding #2: Absence of a formal information’ security management system
Finding #3: Absence of formal procedures to review access
Finding #4: Absence of management engagement on monitoring security objectives

Which of the following is best for the security team to use when remediating the findings?

A. Incorporate PCI DSs compliance.
B. Implement ISO/EC 27001 standard recommendations.
C. Use OWASP to implement consistent security testing.
D. Research appropriate CIS benchmarks and apply them.

Correct Answer: B

QUESTION 107
Which of the following best explains an Al model denial-of-service attack?

A. Users posting large, computationally intensive data sets
B. Untrustworthy and unverified model output
C. An adversary attacking the API of an Al service
D. Using the model output to understand its parameters or architecture

Correct Answer: A

QUESTION 108
A company is preparing to move a new version of a web application to production. No issues were reported during security scanning or quality assurance in the CI/CD pipeline. Which of the following actions should the company take next?

A. Merge the test branch to the main branch.
B. Perform threat modeling on the production application.
C. Conduct unit testing on the submitted code.
D. Perform a peer review on the test branch.

Correct Answer: A

QUESTION 109
A security engineer wants to improve the security of an application as part of the development pipeline. The engineer reviews the following component of an internally developed web application that allows employees to manipulate documents from a number of internal servers:
response = requests.get (url)
Users can specify the document to be parsed by passing the document URL to the application as a parameter.

Which of the following is the best solution to verify the quality and security of this component?

A. Indexing
B. Output encoding
C. Code scanner
D. Penetration testing

Correct Answer: D

QUESTION 110
A company is moving several of its systems to a multicloud environment and wants to automate the creation of the new servers using a standard image. Which of the following should the company implement to best support this goal?

A. PowerShell
B. Bash
C. Terraform
D. Ansible

Correct Answer: C

QUESTION 111
Engineers at a cloud service provider can now access newly deployed customer environments from their personal laptops. The engineers are concerned that unmanaged systems may present unknown vulnerabilities to customer environments, which might become a significant liability to the service provider. Which of the following deployments provides the most secure solution to prevent access through non-authorized endpoints?

A. Modifying MDM policies to provide device attestation on all devices connecting to the cloud service’s management console
B. Requiring that a corporate-licensed and -managed EDR solution is installed on employee-owned laptops
C. Configuring the device’s certificate-based authentication on the corporate VPN and requiring that all activity in customer environments be performed using the VPN
D. Implementing host checking on remote desktop sessions to jump boxes used for managing customer environments

Correct Answer: C

QUESTION 112
A security engineer receives the following findings from a recent security audit.
1. Data should be protected based on user permissions and roles.
2. User action tracking should be implemented across the network.
3. Digital identities should be validated across the data access workflow.

Which of the following is the first action the engineer should take to address the findings?

A. Implement continuous and context-based authentication and authorization.
B. Use an enhanced user credential provisioning workflow and data monitoring tools.
C. Improve federation services for digital identities and data access.
D. Deploy OpenID Connect for application programming interface authentication.

Correct Answer: C

QUESTION 113
A security architect is working with a client to develop cloud-focused zero trust solutions to protect employee access to the organization’s resources. The client organization wants to replace a traditional SSL VPN solution with a clientless solution that secures access to web-based applications. Which of the following best addresses the requirements?

A. SD-WAN
B. Always-on VPN
C. SASE
D. PAM
E. Conditional access

Correct Answer: C

QUESTION 114
An organization wants to implement a secure cloud architecture across all instances. Given the following requirements:
1. Establish a standard network template.
2. Deployments must be consistent.
3. Security policies must be able to be changed at scale.

Which of the following technologies meets these requirements?

A. Serverless deployment model
B. Container orchestration
C. Infrastructure as code
D. CLI cloud administration
E. API gateway

Correct Answer: C

QUESTION 115
A company’s headquarters is in an area with a high rate of severe weather. An engineer must update the enterprise architecture to meet the following requirements:
1. Critical services must remain functional without downtime.
2. Backups of data and configurations must be securely implemented. Company workstations must be highly available and remotely reachable.

Which of the following solutions is the best way to meet these requirements?

A. Transition physical resources to virtual resources with standby redundant servers, and install a high capacity, diesel-powered backup generator.
B. Open and staff a second data center at least 100 miles away with robust, network-attached storage, and include DAR encryption for offline backups of customer data to enable rapid recovery.
C. Lease a cross-country workspace to support as-needed relocation of staff and equipment, and continuously back up and test VM images with automatic recovery orchestration.
D. Implement a geographically distributed allocation of physical resources and VDI with continuous replication connected via site-to-site and load-balanced IPSec VPNs.

Correct Answer: D

QUESTION 116
A company has the following requirements for a cloud-based web application:
1. Must authenticate customers
2. Must prevent data exposure
3. Must allow customer access to data throughout the cloud environment
4. Must restrict access by specific regions

Which of the following solutions best addresses these security requirements?

A. Applying role-based access controls and configuring geolocation policies
B. Replicating the data in each customer environment
C. Hosting the data regionally and providing each customer with a unique link
D. Moving to a cloud provider that operates only in one specific region

Correct Answer: A

QUESTION 117
Which of the following best describes the reason a network architect would enable forward secrecy on all VPN tunnels?

A. This process is a requirement to enable hardware-accelerated cryptography.
B. This process reduces the success of attackers performing cryptanalysis.
C. The business requirements state that confidentiality is a critical success factor.
D. Modern cryptographic protocols list this process as a prerequisite for use.

Correct Answer: B

QUESTION 118
A global company has data centers on multiple continents. The company suffers a breach due to a poorly secured, publicly available web server. The attacker pivots from the web server to several other enterprise servers. Which of the following would be the best way to prevent an attacker from accessing multiple enterprise servers from this single web server?

A. Context-based authentication
B. Screened subnet
C. Microsegmentation
D. Edge firewall

Correct Answer: C

QUESTION 119
Company A acquired Company B. Both companies serve a user base in different geographic regions but now collectively serve a globally distributed user base. A security architect needs to design resilient monitoring systems with the following requirements:
1. User data must remain on the systems of each respective company.
2. Low latency is needed for all users regardless of company location and user location.
3. Each company must have its own redundancy.

Which of the following practices are the most beneficial in meeting the requirements? (Select two).

A. Replicating each company’s system in the other company’s region
B. Configuring SSO and consolidating identity providers
C. Implementing a network load balancer
D. Deploying a reverse proxy
E. Utilizing an API gateway
F. Enabling automated vertical scaling

Correct Answer: CD

QUESTION 120
A security architect is designing Zero Trust enforcement policies for all end users. The majority of users work remotely and travel frequently for work Which of the following controls should the security architect do first?

A. Switch user MFA from software-based tokens to hardware time-based OTPs.
B. Implement TLS decryption and inspect inbound and outbound network traffic.
C. Enforce daily posture compliance checks against the endpoint security controls.
D. Deploy context-aware reauthentication with UBA baseline deviations.

Correct Answer: C