Security+ SY0-701 Domain Practice

During a security assessment, an organization discovers that their current intrusion detection system generates numerous alerts for normal business activities that deviate slightly from baseline patterns. What is the MOST likely cause of this issue?

• ○ The IDS uses only signature-based detection
• ✓ The anomaly detection threshold is set too low
• ○ The IDS is placed on a SPAN port instead of inline
• ○ The organization lacks a host-based IDS

An employee is required to use a smart card plus a PIN to access the system. This is an example of:

• ○ Single-factor authentication
• ✓ Multi-factor authentication
• ○ Biometric authentication
• ○ Federated identity

A security analyst is responding to a ransomware incident. Which THREE steps, in order, should be performed FIRST, SECOND, and THIRD according to PICERL? (Choose THREE)

• ✓ Contain the spread to other systems
• ○ Eradicate malware from infected systems
• ✓ Identify the initial infection vector
• ○ Restore data from backups
• ✓ Preserve forensic evidence

A financial institution is considering outsourcing its data processing to a third-party vendor. Under GLBA, what must the institution ensure about this vendor relationship?

• ○ The vendor signs a Business Associate Agreement
• ○ The vendor undergoes PCI DSS certification
• ✓ The vendor complies with the institution's information security program
• ○ The vendor appoints a Data Protection Officer

A security analyst notices that legitimate emails from company vendors are being marked as spam because the sending domains lack proper authentication records. Which technology should be recommended to the vendors to solve this problem?

• ○ DMARC
• ○ SPF
• ✓ DKIM
• ○ Content filtering