As part of an incident investigation, an analyst creates a detailed document that describes all activities, timelines, root causes, and mitigation actions. Which of the following reports is the analyst creating?
A. Lessons learned
B. Business impact analysis
C. Tabletop exercise
D. Change control
Show Answer
Correct Answer: A
Explanation: A lessons learned report is produced after an incident and documents the incident timeline, activities performed, root cause analysis, mitigation actions, and recommendations for improving future response. The other options do not describe a post-incident investigation report: a business impact analysis assesses business consequences, a tabletop exercise is a discussion-based drill, and change control manages system changes.
Question 59
A systems administrator receives several reports about emails containing phishing links. The hosting domain is always different, but the URL follows a specific pattern of characters.
Which of the following is the best way for the administrator to find more messages that were not reported?
A. Search email logs for a regular expression.
B. Open a support ticket with the email hosting provider.
C. Send a memo to all staff asking them to report suspicious emails.
D. Query firewall logs for any traffic with a suspicious website.
Show Answer
Correct Answer: A
Explanation: A regular expression search against email logs is the best way to identify additional phishing emails when the hosting domain changes but the URL follows a consistent character pattern. Regex can match the invariant URL structure across different domains, making it effective for finding unreported messages. The other options are reactive or search the wrong data source.
Question 59
A vulnerability scanner generates the following output:
The company has an SLA for patching that requires time frames to be met for high-risk vulnerabilities. Which of the following should the analyst prioritize first for remediation?
A. Oracle JDK
B. Cisco Webex
C. Redis Server
D. SSL Self-signed Certificate
Show Answer
Correct Answer: C
Explanation: Redis Server is an active, high-severity finding (CVSS 7.5) that has remained open for 43 days, making it the clearest priority under the stated high-risk patching SLA. The critical Oracle JDK finding also needs urgent verification and remediation, but it resurfaced only four days ago.
Sources:
https://www.governmentjobs.com/careers/montcopa/jobs/newprint/5354147
Question 60
A company recently removed administrator rights from all of its end user workstations. An analyst uses CVSSv3.1 exploitability metrics to prioritize the vulnerabilities for the workstations and produces the following information:
Which of the following vulnerabilities should be prioritized for remediation?
A. nessie.explosion
B. vote.4p
C. sweet.bike
D. great.skills
Show Answer
Correct Answer: D
Explanation: Prioritize great.skills. It is network-accessible (AV:N), has low attack complexity (AC:L), requires no privileges (PR:N), and requires no user interaction (UI:N), making it the most exploitable. Removing administrator rights from workstations further reduces the practical risk of vulnerabilities requiring high privileges.
Question 61
An e-commerce organization recently experienced a cyberattack. During a lessons learned meeting, a cybersecurity analyst requests that the RTO is prioritized. Which of the following is the greatest concern?
A. Integrity
B. Availability
C. Non-repudiation
D. Confidentiality
Show Answer
Correct Answer: B
Explanation: Recovery Time Objective (RTO) is the maximum acceptable downtime after a disruption before business impact becomes unacceptable. Prioritizing RTO means the primary concern is restoring services quickly, which directly addresses the availability of systems and services. Integrity, confidentiality, and non-repudiation are different security objectives and are not what RTO primarily measures.
Question 61
A security analyst is validating a particular finding that was reported in a web application vulnerability scan to make sure it is not a false positive. The security analyst uses the snippet below:
Which of the following vulnerability types is the security analyst validating?
A. Directory traversal
B. XSS
C. XXE
D. SSRF
Show Answer
Correct Answer: C
Explanation: The XML defines an external entity that points to the server’s local `/etc/shadow` file and references that entity in the document. Resolving it could expose the file contents, which is characteristic of an XML External Entity (XXE) vulnerability.
Question 62
A security analyst is assessing the security of a cloud environment. The following output is generated when the assessment runs:
Authentication error -
Instance not found on preset location
Which of the following should the analyst use to fix the issue?
A. run module_name and exec
B. --session and --module-args=" "
C. set_regions and set_key
D. --whoami and --data
Show Answer
Correct Answer: C
Explanation: The error combines an authentication problem with an inability to locate the instance in the configured location. Configuring the correct cloud region and the appropriate authentication key addresses both issues. The other options are generic execution or query flags that do not resolve region and credential configuration.
Question 62
An incident response team member is triaging a Linux server. The output is shown below:
Which of the following is the adversary most likely trying to do?
A. Create a backdoor root account named zsh.
B. Execute commands through an unsecured service account.
C. Send a beacon to a command-and-control server.
D. Perform a denial-of-service attack on the web server.
Show Answer
Correct Answer: B
Explanation: The HTTP service account (`http`) has an interactive `/bin/bash` shell, and the suspicious request includes commands to download a file and run `whoami`. This suggests an attempt to execute commands via the service account, rather than creating a `zsh` user or simply beaconing to a C2 server.
Question 63
A security analyst is reviewing the following alert that was triggered by FIM on a critical system:
Which of the following best describes the suspicious activity that is occurring?
A. A fake antivirus program was installed by the user.
B. A network drive was added to allow exfiltration of data.
C. A new program has been set to execute on system start.
D. The host firewall on 192.168.1.10 was disabled.
Show Answer
Correct Answer: C
Explanation: A new value named `RunMe` was added under `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`, pointing to `%appdata%\abc.exe`. The Windows Run key is used to launch programs automatically at startup, so this indicates a program has been configured to execute when the system starts.
Question 63
A security analyst is looking for information that would serve as an indicator that a given IP address is Involved in other attacks. Which of the following sources of information should the analyst use to achieve this objective?
A. AbuseIPDB
B. Autonomous System Number
C. Whois
D. Cuckoo Sandbox
Show Answer
Correct Answer: A
Explanation: AbuseIPDB is a threat intelligence and reputation service that aggregates reports of malicious activity associated with IP addresses, making it an appropriate source to determine whether an IP has been involved in other attacks. An Autonomous System Number identifies the network operator, Whois provides registration information, and Cuckoo Sandbox is used for malware analysis rather than IP reputation.
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
