Which of the following responsibilities does the legal team have during an incident management event? (Choose two).
A. Coordinate additional or temporary staffing for recovery efforts.
B. Review and approve new contracts acquired as a result of an event.
C. Advise the incident response team on matters related to regulatory reporting.
D. Ensure all system security devices and procedures are in place.
E. Conduct computer and network damage assessments for insurance.
F. Verify that all security personnel have the appropriate clearances.
Show Answer
Correct Answer: B, C
Explanation: The legal team's responsibilities during incident management include advising the incident response team on legal and regulatory obligations, including breach notification and reporting requirements, and reviewing or approving legal agreements such as new contracts that may be required as a result of the incident. The other options align with HR (staffing, clearances) or security/technical teams (security controls, damage assessments).
Question 142
In the last hour, a high volume of failed RDP authentication attempts has been logged on a critical server. All of the authentication attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following mitigating controls would be most effective to reduce the rate of success of this brute-force attack? (Choose two.)
A. Increase the granularity of log-on event auditing on all devices.
B. Enable host firewall rules to block all outbound traffic to TCP port 3389.
C. Configure user account lockout after a limited number of failed attempts.
D. Implement a firewall block for the IP address of the remote system.
E. Install a third-party remote access tool and disable RDP on all devices.
F. Block inbound to TCP port 3389 from untrusted remote IP addresses at the perimeter firewall.
Show Answer
Correct Answer: C, F
Explanation: Configuring account lockout limits repeated password guesses against the valid account, reducing the chance of a successful brute-force attack. Restricting inbound RDP (TCP 3389) at the perimeter firewall to trusted IP addresses prevents untrusted remote hosts from attempting RDP authentication in the first place. The other options are either monitoring only, target the wrong traffic direction, are overly disruptive, or are less effective as a general mitigating control.
Question 143
An analyst is reviewing a dashboard from the company’s SIEM and finds that an IP address known to be malicious can be tracked to numerous high-priority events in the last two hours. The dashboard indicates that these events relate to TTPs. Which of the following is the analyst most likely using?
A. MITRE ATT&CK
B. OSSTMM
C. Diamond Model of Intrusion Analysis
D. OWASP
Show Answer
Correct Answer: A
Explanation: MITRE ATT&CK is the framework that organizes adversary Tactics, Techniques, and Procedures (TTPs). SIEM dashboards commonly map alerts and correlated events to MITRE ATT&CK techniques and tactics to help analysts understand attacker behavior. OSSTMM is a security testing methodology, the Diamond Model is an intrusion analysis model but not the standard TTP mapping shown in SIEM dashboards, and OWASP focuses on web application security.
Question 144
A company has recently experienced a security breach via a public-facing service. Analysis of the event on the server was traced back to the following piece of code:
SELECT * From user_data WHERE Username = 0 and userid= 1 or 1=1;--
Which of the following controls would be best to implement?
A. Deploy a wireless application protocol.
B. Remove the end-of-life component.
C. Implement proper access control.
D. Validate user input.
Show Answer
Correct Answer: D
Explanation: The query shows a classic SQL injection payload (`1 OR 1=1;--`), where untrusted input alters the SQL logic. The most appropriate control is to validate and sanitize user input (and, in practice, use parameterized queries/prepared statements) to prevent SQL injection. The other options do not directly mitigate this vulnerability.
Question 145
An organization wants to establish a disaster recovery plan for critical applications that are hosted on premises. Which of the following is the first step to prepare for supporting this new requirement?
A. Choose a vendor to utilize for the disaster recovery location.
B. Establish prioritization of continuity from data and business owners.
C. Negotiate vendor agreements to support disaster recovery capabilities.
D. Advise the leadership team that a geographical area for recovery must be defined.
Show Answer
Correct Answer: B
Explanation: The first step in disaster recovery planning is to identify and prioritize business-critical systems and recovery requirements through a business impact analysis with data and business owners. Those priorities drive recovery objectives and inform later decisions such as selecting vendors, negotiating agreements, and choosing a recovery location.
Question 146
A security analyst working for an airline is prioritizing vulnerabilities found on a system. The system has the following requirements:
• Can store periodically audited documents required for takeoffs and landings
• Can keep critical records regarding the company’s operations
• Data can be made public upon request and authorization
Which of the following vulnerabilities should be remediated first?
A. A broken access control vulnerability impacting data integrity
B. A heap overflow vulnerability impacting the system’s usability
C. A DoS vulnerability impacting the system’s availability
D. A zero-day vulnerability impacting the system’s confidentiality
Show Answer
Correct Answer: A
Explanation: The system's primary purpose is to store periodically audited operational documents and critical company records. The fact that documents are audited and must remain accurate makes integrity the highest priority. A broken access control flaw that allows unauthorized modification of records threatens the trustworthiness of takeoff/landing documentation and operational records. Confidentiality is less critical because the data may be released with authorization, and availability/usability, while important, is secondary to ensuring the records are accurate and unaltered.
Question 147
A security analyst is improving an organization’s vulnerability management program. The analyst cross-checks the current reports with the system’s infrastructure teams, but the reports do not accurately reflect the current patching levels. Which of the following will most likely correct the report errors?
A. Updating the engine of the vulnerability scanning tool
B. Installing patches through a centralized system
C. Configuring vulnerability scans to be credentialed
D. Resetting the scanning tool’s plug-ins to default
Show Answer
Correct Answer: C
Explanation: Credentialed vulnerability scans authenticate to target systems and inspect installed patches and software directly, providing far more accurate patch-level reporting than unauthenticated scans. Updating the scan engine or resetting plug-ins may affect detection capabilities but does not address inaccurate visibility into actual installed patches. Centralized patching improves deployment but does not itself correct inaccurate vulnerability reports.
Question 148
A security analyst is reviewing a recent vulnerability scan report for a new server infrastructure. The analyst would like to make the best use of time by resolving the most critical vulnerability first. The following information is provided:
Which of the following should the analyst concentrate remediation efforts on first?
A. SVR01
B. SVR02
C. SVR03
D. SVR04
Show Answer
Correct Answer: B
Explanation: Prioritize remediation based on both severity and exploitability. A vulnerability with the highest score but that is not currently exploitable is generally a lower immediate priority than a slightly lower-scoring vulnerability that is exploitable. Based on the provided context, SVR02 represents the highest-priority actionable risk.
Question 149
Several incidents have occurred with a legacy web application that has had little development work completed. Which of the following is the most likely cause of the incidents?
A. Misconfigured web application firewall
B. Data integrity failure
C. Outdated libraries
D. Insufficient logging
Show Answer
Correct Answer: C
Explanation: A legacy web application with little ongoing development is most likely running outdated third-party libraries or frameworks. These components often contain known vulnerabilities that lead to security incidents if they are not patched. A misconfigured WAF would require recent configuration issues, data integrity failure is more likely a consequence than a root cause, and insufficient logging affects detection rather than causing incidents.
Question 150
Results of a SOC customer service evaluation indicate high levels of dissatisfaction with the inconsistent services provided after regular work hours. To address this, the SOC lead drafts a document establishing customer expectations regarding the SOC’s performance and quality of services. Which of the following documents most likely fits this description?
A. Risk management plan
B. Vendor agreement
C. Incident response plan
D. Service-level agreement
Show Answer
Correct Answer: D
Explanation: A service-level agreement (SLA) defines the expected level of service, including performance targets, response and resolution times, availability, and service quality. It establishes clear customer expectations and is the appropriate document to address inconsistent after-hours SOC service.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.