A list of IoCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost.exe. Which of the following best describes the result if security teams add this indicator to their detection signatures?
A. This indicator would fire on the majority of Windows devices.
B. Malicious files with a matching hash would be detected.
C. Security teams would detect rogue svchost.exe processes in their environment.
D. Security teams would detect event entries detailing execution of known-malicious svchost.exe processes.
Show Answer
Correct Answer: A
Explanation: A SHA-256 hash uniquely identifies an exact file. Using the hash of a Microsoft-signed, legitimate svchost.exe as an IoC would match the genuine binary present on most Windows systems, causing alerts to trigger broadly across the environment rather than indicating malicious activity.
Question 127
When undertaking a cloud migration of multiple SaaS applications, an organization’s systems administrators struggled with the complexity of extending identity and access management to cloud-based assets. Which of the following service models would have reduced the complexity of this project?
A. OpenID
B. SDN
C. ZTNA
D. SWG
Show Answer
Correct Answer: A
Explanation: The problem describes difficulty extending identity and access management to multiple SaaS applications during a cloud migration. Federated identity and single sign-on directly reduce this complexity by centralizing authentication rather than managing separate identities per SaaS. OpenID is specifically designed to provide standardized federated authentication across cloud and SaaS services, simplifying IAM integration. The other options (SDN, ZTNA, SWG) are networking or access control architectures that add security controls but do not primarily simplify IAM federation across SaaS applications.
Question 128
A security analyst needs to prioritize vulnerabilities for patching. Given the following vulnerability and system information:
Which of the following systems should the analyst patch?
A. 1
B. 2
C. 3
D. 4
E. 5
F. 6
Show Answer
Correct Answer: D
Explanation: System 4 presents the highest risk based on vulnerability prioritization factors: it is internet-facing (network attack vector), requires no privileges and no user interaction, has low attack complexity, and includes a changed scope indicating potential impact beyond the host. These characteristics make it the most likely to be exploited and the most damaging, so it should be patched first.
Question 129
Which of the following features is a key component of Zero Trust architecture?
A. Single strong source of user identity
B. Implementation of IT governance
C. Business continuity plan
D. Quality assurance
E. Internal auditing process
Show Answer
Correct Answer: A
Explanation: Zero Trust architecture is built on continuous verification of identity and access. A single, strong source of user identity (often backed by MFA, identity federation, and continuous authentication) is a core component, ensuring every access request is authenticated and authorized regardless of network location. The other options are general IT or governance practices, not defining elements of Zero Trust.
Question 130
Which of the following are process improvements that can be realized by implementing a SOAR solution? (Choose two.)
A. Minimize security attacks.
B. Itemize tasks for approval.
C. Reduce repetitive tasks.
D. Minimize setup complexity.
E. Define a security strategy.
F. Generate reports and metrics.
Show Answer
Correct Answer: C, F
Explanation: SOAR (Security Orchestration, Automation, and Response) platforms improve processes by automating and orchestrating security workflows. This directly reduces repetitive, manual tasks performed by analysts and enables consistent generation of reports and metrics from automated workflows and incident data. The other options relate to strategic planning, attack prevention, or deployment complexity, which are not core process improvements delivered by SOAR.
Question 131
The security team reviews a web server for XSS and runs the following Nmap scan:
Which of the following most accurately describes the result of the scan?
A. An output of characters > and " as the parameters used in the attempt
B. The vulnerable parameter ID http://172.31.15.2/1.php?id=2 and unfiltered characters returned
C. The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe
D. The vulnerable parameter id=2 with a SQL injection attempt
Show Answer
Correct Answer: C
Explanation: The Nmap XSS-related script (e.g., http-unsafe-output-escaping) tests whether user-supplied input is reflected back without proper escaping. The scan result indicates that the parameter (id) reflects special characters such as > and " either unfiltered or improperly encoded, which is characteristic of an XSS condition. It is not merely listing the payload characters (A), does not confirm full reflected content beyond unsafe escaping (B), and is unrelated to SQL injection (D).
Question 132
A cybersecurity analyst is setting up a security control that monitors network traffic and produces an active response to a security event. Which of the following tools is the analyst configuring?
A. EDR
B. IPS
C. CASB
D. WAF
Show Answer
Correct Answer: B
Explanation: An Intrusion Prevention System (IPS) monitors network traffic and can actively respond to security events by blocking or mitigating malicious traffic in real time. The other options do not primarily provide inline network traffic prevention.
Question 133
A security analyst has identified outgoing network traffic leaving the enterprise at odd times. The traffic appears to pivot across network segments and target domain servers. The traffic is then routed to a geographic location to which the company has no association. Which of the following best describes this type of threat?
A. Hacktivist
B. Zombie
C. Insider threat
D. Nation-state actor
Show Answer
Correct Answer: D
Explanation: The behavior described—odd-hour outbound traffic, lateral movement across network segments, targeting domain servers, and exfiltration to a foreign, unrelated geographic location—matches a sophisticated, stealthy campaign typical of an advanced persistent threat. These characteristics align best with a nation-state actor. A zombie describes a compromised host, not the overarching threat actor, and there is no indication of hacktivist motives or an insider.
Question 134
An XSS vulnerability was reported on one of the public websites of a company. The security department confirmed the finding and needs to provide a recommendation to the application owner. Which of the following recommendations will best prevent this vulnerability from being exploited? (Choose two.)
A. Implement an IPS in front of the web server.
B. Enable MFA on the website.
C. Take the website offline until it is patched.
D. Implement a compensating control in the source code.
E. Configure TLS v1.3 on the website.
F. Fix the vulnerability using a virtual patch at the WA
Show Answer
Correct Answer: D, F
Explanation: Cross-site scripting is best prevented by addressing it at the application layer and by blocking known exploit patterns at the edge. Implementing compensating controls in the source code (such as proper input validation, output encoding, and CSP) fixes the root cause and provides a durable solution. Applying a virtual patch via a WAF adds immediate protection by filtering malicious XSS payloads while code-level fixes are deployed. Other options either do not address XSS directly (MFA, TLS), are less targeted (IPS), or harm availability without being a sustainable security recommendation (taking the site offline).
Question 135
An analyst is investigating a phishing incident and has retrieved the following as part of the investigation:
cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -
EncodedCommand
A. Echo the command payload content into ‘base64 -d‘.
B. Execute the command from a Windows VM.
C. Use a command console with administrator privileges to execute the code.
D. Run the command as an unprivileged user from the analyst workstation.
Show Answer
Correct Answer: A
Explanation: The command uses PowerShell’s -EncodedCommand flag, which means the actual payload is Base64-encoded. The safest and most informative first step in an investigation is to decode the payload (e.g., Base64-decode it) to inspect what the script does without executing potentially malicious code. Running it directly, even in a VM, introduces unnecessary risk when the script can be analyzed statically.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.