A security analyst is reviewing the following Internet usage trend report:

Which of the following usernames should the security analyst investigate further?

1. A. User1
2. B. User 2
3. C. User 3
4. D. User 4

Correct Answer: D
The Internet usage trend report shows that User 4 has an unusually high amount of data downloaded compared to other users. User 4 downloaded 2.5 GB of data in one day, while the average data downloaded by other users was around 0.2 GB. This could indicate that User 4 is engaged in some suspicious or malicious activity, such as downloading unauthorized or illegal content, exfiltrating sensitive data, or installing malware. Therefore, the security analyst should investigate User 4 further to determine the nature and source of the data downloaded.

At which of the following phases of the SDLC shoukJ security FIRST be involved?

1. A. Design
2. B. Maintenance
3. C. Implementation
4. D. Analysis
5. E. Planning
6. F. Testing

Correct Answer: E
The software development life cycle (SDLC) is a process that consists of several phases that guide the development of software applications or systems. Security should be involved in every phase of the SDLC, but especially in the planning phase, which is the first phase where the scope, objectives, requirements, and resources of the project are defined. By involving security in the planning phase, potential risks and threats can be identified and mitigated early in the process, which can save time, money, and effort later on. Design, maintenance, implementation, analysis, and testing are other phases of the SDLC, but they are not the first phase where security should be involved. Reference:
https://www.bmc.com/blogs/software-development-life-cycle-phases/

A forensics investigator is analyzing a compromised workstation. The investigator has cloned the hard drive and needs to verify that a bit-level image copy of a hard drive is an exact clone of the original hard drive that was collected as evidence. Which of the following should the investigator do?

1. A. Insert the hard drive on a test computer and boot the computer.
2. B. Record the serial numbers of both hard drives.
3. C. Compare the file-directory "sting of both hard drives.
4. D. Run a hash against the source and the destination.

Correct Answer: D
A hash is a mathematical function that produces a unique value for a given input. A hash can be used to verify that a bit-level image copy of a hard drive is an exact clone of the original hard drive by comparing the hash values of both drives. If the hash values match, then the drives are identical. If the hash values differ, then there is some discrepancy between the drives. Inserting the hard drive on a test computer and booting the computer, recording the serial numbers of both hard drives, or comparing the file-directory listing of both hard drives are not reliable methods to verify that a bit-level image copy of a hard drive is an exact clone of the original hard drive. Reference: https://www.forensicswiki.org/wiki/Hashing

Which of the following is the most effective approach to minimize the occurrence of vulnerabilities introduced by unintentional misconfigurations in the cloud?

1. A. Requiring security training certification before granting access to staff
2. B. Migrating all resources to a private cloud deployment
3. C. Restricting changes to the deployment of validated laC templates
4. D. Reducing laaS deployments by fostering serverless architectures

Correct Answer: C
IaC stands for infrastructure as code, which is a practice of using code or configuration files to automate the provisioning and management of cloud resources. IaC templates can help ensure consistency, repeatability, and scalability of cloud deployments, as well as reduce human errors and misconfigurations. However, IaC templates need to be validated and tested before deployment, and any changes to the templates should be controlled and monitored. This can help minimize the occurrence of vulnerabilities introduced by unintentional misconfigurations in the cloud

An application must pass a vulnerability assessment to move to the next gate. Consequently, any security issues that are found must be remediated prior to the next gate. Which of the following best describes the method for end-to-end vulnerability assessment?

1. A. Security regression testing
2. B. Static analysis
3. C. Dynamic analysis
4. D. Stress testing

Correct Answer: C
Dynamic analysis is a method for end-to-end vulnerability assessment that involves testing an application while it is running, by simulating user inputs, network traffic, or environmental conditions. Dynamic analysis can help identify security issues that may arise from the interaction between different components of the application, such as logic flaws, input validation errors, or session management weaknesses.