The Chief Information Security Officer wants the same level of security to be present whether a remote worker logs in at home or at a coffee shop. Which of the following should be recommended as a starting point?
A. Non-persistent virtual desktop infrastructures
B. Passwordless authentication
C. Standard-issue laptops
D. Serverless workloads
Show Answer
Correct Answer: A
Explanation: Non-persistent VDI provides a centrally managed desktop environment with consistent security controls regardless of the user's physical location or local network. Because sessions are reset after logout and data remains centralized, it helps ensure the same security posture whether connecting from home or a public Wi-Fi network. Passwordless authentication strengthens authentication only, standard-issue laptops improve device consistency but not location-independent security, and serverless workloads are unrelated to remote endpoint access.
Question 75
A security analyst at a company is reviewing an alert from the file integrity monitoring indicating a mismatch in the login. html file hash. After comparing the code with the previous version of the page source code, the analyst found the following code snippet added:
Which of the following best describes the activity the analyst has observed?
A. Obfuscated links
B. Exfiltration
C. Unauthorized changes
D. Beaconing
Show Answer
Correct Answer: B
Explanation: The added JavaScript sends the login email and password in a POST request to an external domain, which is code designed to exfiltrate credentials. The file hash mismatch indicates a change, but the snippet’s behavior is best described as exfiltration.
Question 76
A technician is analyzing output from a popular network mapping tool for a PCI audit:
Which of the following best describes the output?
A. The host is not up or responding.
B. The host is running excessive cipher suites.
C. The host is allowing insecure cipher suites.
D. The Secure Shell port on this host is closed.
Show Answer
Correct Answer: C
Explanation: The Nmap output shows TLS cipher suites rated F and warns that the certificate uses an insecure SHA-1 signature. This indicates the host allows insecure TLS configurations. The host is up, and SSH on port 22 is open.
Question 76
A finance department employee opens an unsolicited email that contains a malicious payload. The payload quickly spreads through the finance department, but does not affect other departments. Which of the following best explains why the payload does not affect all departments?
A. OS version
B. Offline computers
C. Firewall configuration
D. Network segmentation
Show Answer
Correct Answer: D
Explanation: The malware spreads within the finance department but not to other departments, indicating that the network is segmented into separate security or broadcast domains (such as VLANs or subnets) that restrict lateral movement. OS version, offline computers, or firewall configuration do not as directly explain why the spread is contained specifically along departmental boundaries.
Question 77
A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:
Which of the following scripting languages was used in the script?
A. PowerShell
B. Ruby
C. Python
D. Shell script
Show Answer
Correct Answer: A
Explanation: The script uses PowerShell syntax and Active Directory cmdlets such as `Get-ADUser`, `Add-ADGroupMember`, and `Set-ADUser`.
Question 77
Which of the following explains why a company would consider enriching data before sending it to the SIEM?
A. To prevent injection attacks against the log management system
B. To reduce the amount and cost of data storage for security incidents
C. To provide more information to SOC analysts when analyzing events
D. To normalize the data before saving it to the database tables
Show Answer
Correct Answer: C
Explanation: Data enrichment adds contextual information (such as asset details, user identity, threat intelligence, or geolocation) to raw events before they reach the SIEM. This gives SOC analysts more context for investigation and correlation. It is not primarily intended to prevent injection attacks, reduce storage costs, or normalize data (normalization is a separate processing step).
Question 78
A security analyst is performing a malware analysis on a device and receives the following instructions:
• Reduce the blast radius of the potential threat.
• Preserve forensic data for post-incident analysis.
• If securely possible, preserve connectivity for live analysis.
Which of the following will best help the analyst during the investigation?
A. Configure an EDR agent to isolate the network with authorized exceptions to the NOC VLAN.
B. Execute a SOAR playbook to trigger a malware scan on the company's assets.
C. Use file integrity monitoring to determine if the suspicious file was modified.
D. Collect the suspicious file using SFTP and reimage the device.
Show Answer
Correct Answer: A
Explanation: The best choice is to use an EDR agent to isolate the affected endpoint while allowing authorized exceptions for security operations. This reduces the malware's ability to spread, preserves the system in its current state for forensic analysis, and maintains limited connectivity for live investigation if needed. The other options either do not contain the threat, are not focused on the affected device, or destroy valuable forensic evidence by reimaging.
Question 80
A company suspects a coordinated effort to attack their platform. Web server logs show malicious activity from many different source IP addresses located in different countries. Which of the following will best help a security analyst identify the requests connected to this campaign?
A. Modify the web server logs to include the X-Forwarded-For header.
B. Create a custom SIEM query to integrate threat intel IoCs associated with the threat actor.
C. Enrich the web server request logs with full WHOIS data on all available sources.
D. Add GeoIP location for the source IP addresses to the log entries.
Show Answer
Correct Answer: B
Explanation: A coordinated campaign using many IP addresses is best identified by correlating web requests with known threat intelligence indicators of compromise (IoCs) associated with a threat actor. X-Forwarded-For helps recover original client IPs when proxies/load balancers are involved, but it does not identify which requests belong to a specific campaign. WHOIS and GeoIP provide context but are not effective for campaign attribution.
Sources:
https://www.recordedfuture.com/case-study/tbi-bank
https://www.misp-project.org
Question 81
A SOC analyst is reviewing the weekly EDR report. The report shows that the same application was blocked once every 24 hours. Which of the following tools should the analyst use to further investigate the incident?
A. Registry Editor
B. services.msc
C. Task Scheduler
D. MSConfig
Show Answer
Correct Answer: C
Explanation: A program being blocked once every 24 hours strongly suggests it is being launched on a recurring schedule. Windows Task Scheduler is the primary tool used to configure and inspect scheduled tasks, making it the appropriate place to investigate recurring execution. Registry Editor, Services, and MSConfig are used for other persistence and startup mechanisms but do not specifically explain a precise 24-hour recurrence.
Question 83
An after-action review of a ransomware attack on a company identified deficiencies in responsiveness and consistency. Which of the following choices would best facilitate improvement of these deficiencies?
A. Leverage a SIEM.
B. Utilize threat intelligence sharing.
C. Source multiple threat feeds.
D. Implement SOAR.
Show Answer
Correct Answer: D
Explanation: SOAR (Security Orchestration, Automation, and Response) directly improves incident response responsiveness and consistency by automating workflows, enforcing standardized playbooks, and orchestrating actions across security tools. A SIEM primarily improves visibility and detection, while threat intelligence sharing and multiple threat feeds enhance awareness and detection rather than response execution.
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
