An analyst has discovered the following suspicious command:
"; $xyz = ($_REQUEST['xyz']); system($xyz); echo ""; die; }?>
Which of the following would best describe the outcome of the command?
A. Cross-site scripting
B. Reverse shell
C. Backdoor attempt
D. Logic bomb
Show Answer
Correct Answer: C
Explanation: The PHP snippet reads a value from the HTTP request ($_REQUEST['xyz']) and passes it directly to system(), allowing arbitrary OS commands supplied by a remote requester to be executed. This is characteristic of a web shell/backdoor that enables remote command execution, not XSS, a reverse shell by itself, or a logic bomb.
Question 172
Which of the following is the most likely reason for an organization to assign different internal departmental groups during the post-incident analysis and improvement process?
A. To expose flaws in the incident management process related to specific work areas
B. To ensure all staff members get exposure to the review process and can provide feedback
C. To verify that the organization playbook was properly followed throughout the incident
D. To allow cross-training for staff who are not involved in the incident response process
Show Answer
Correct Answer: A
Explanation: Assigning different internal departmental groups during post-incident analysis helps identify process weaknesses and lessons specific to each functional area. The goal is to uncover gaps and improve the incident management process across the organization, rather than primarily auditing playbook compliance, rotating staff through reviews, or providing cross-training.
Question 173
A security analyst is assisting a software engineer with the development of a custom log collection and alerting tool (SIEM) for a proprietary system. The analyst is concerned that the tool will not detect known attacks and behavioral IoCs. Which of the following should be configured in order to resolve this issue?
A. Randomly generate and store all possible file hash values.
B. Create a default rule to alert on any change to the system.
C. Integrate with an open-source threat intelligence feed.
D. Manually add known threat signatures into the tool.
Show Answer
Correct Answer: C
Explanation: Integrating an open-source threat intelligence feed provides continuously updated indicators of compromise (IoCs), threat signatures, malicious IPs, domains, hashes, and behavioral indicators that a SIEM can use to detect known attacks. Randomly generating hashes is meaningless, alerting on any change creates excessive false positives, and manually adding signatures is not scalable or regularly updated.
Question 174
An auditor is reviewing an evidence log associated with a cyber crime. The auditor notices that a gap exists between individuals who were responsible for holding onto and transferring the evidence between individuals responsible for the investigation. Which of the following best describes the evidence handling process that was not property followed?
A. Validating data integrity
B. Preservation
C. Legal hold
D. Chain of custody
Show Answer
Correct Answer: D
Explanation: A gap in documented possession or transfer of evidence indicates the chain of custody was not properly maintained. Chain of custody requires continuous documentation of who collected, handled, transferred, and stored evidence to preserve its admissibility and integrity. Preservation refers to protecting evidence from alteration, validating data integrity verifies evidence has not changed, and a legal hold concerns retaining potentially relevant information for legal proceedings.
Question 175
A company is in the middle of an incident, and customer data has been breached. Which of the following should the company contact first?
A. Media
B. Public relations
C. Law enforcement
D. Legal
Show Answer
Correct Answer: D
Explanation: Legal should be contacted first to ensure the incident response complies with applicable breach notification laws, preserves privilege where appropriate, manages liability, and coordinates communications with law enforcement, regulators, customers, public relations, and the media. Law enforcement may be contacted subsequently if criminal activity is involved, but legal typically directs that process.
Question 176
Which of the following is the best reason to implement an MOU?
A. To create a business process for configuration management
B. To allow internal departments to understand security responsibilities
C. To allow an expectation process to be defined for legacy systems
D. To ensure that all metrics on service levels are properly reported
Show Answer
Correct Answer: B
Explanation: A Memorandum of Understanding (MOU) documents the roles, responsibilities, expectations, and intentions between parties. In an organizational security context, it helps clarify security responsibilities between internal departments or collaborating parties. The other options describe purposes more closely aligned with configuration management processes, legacy system planning, or service level agreements (SLAs), not an MOU.
Question 177
A list of IoCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost.exe. Which of the following best describes the result if security teams add this indicator to their detection signatures?
A. This indicator would fire on the majority of Windows devices.
B. Malicious files with a matching hash would be detected.
C. Security teams would detect rogue svchost.exe processes in their environment.
D. Security teams would detect event entries detailing execution of known-malicious svchost.exe processes.
Show Answer
Correct Answer: A
Explanation: A SHA-256 hash IOC for a legitimate Microsoft-signed svchost.exe identifies that exact file. Because the legitimate svchost.exe is present on the vast majority of Windows systems, adding its hash as a detection signature would generate matches on most Windows devices, creating widespread benign detections rather than specifically identifying malicious activity.
Question 178
When undertaking a cloud migration of multiple SaaS applications, an organization’s systems administrators struggled with the complexity of extending identity and access management to cloud-based assets. Which of the following service models would have reduced the complexity of this project?
A. OpenID
B. SDN
C. ZTNA
D. SWG
Show Answer
Correct Answer: A
Explanation: OpenID (typically OpenID Connect) is the identity federation/authentication solution that reduces the complexity of extending identity and access management across multiple SaaS applications by enabling single sign-on and federated identities. ZTNA is an access model for secure application access, while SDN and SWG address networking and web security rather than simplifying SaaS identity federation.
Question 179
A security analyst needs to prioritize vulnerabilities for patching. Given the following vulnerability and system information:
Which of the following systems should the analyst patch?
A. 1
B. 2
C. 3
D. 4
E. 5
F. 6
Show Answer
Correct Answer: D
Explanation: Based on the available information, System 4 is the highest priority because it is internet-facing and the described vulnerability characteristics (network attack vector, low attack complexity, no privileges required, no user interaction, and changed scope) indicate high exploitability and potentially broader impact. No web search results were provided.
Question 180
Which of the following features is a key component of Zero Trust architecture?
A. Single strong source of user identity
B. Implementation of IT governance
C. Business continuity plan
D. Quality assurance
E. Internal auditing process
Show Answer
Correct Answer: A
Explanation: Zero Trust architecture is built around verifying every access request based on strong identity, device, and context. A centralized, strong source of user identity is a foundational component that enables authentication, authorization, and continuous verification. The other options are general organizational or governance practices rather than core Zero Trust architecture features.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.