Which of the following are process improvements that can be realized by implementing a SOAR solution? (Choose two.)
A. Minimize security attacks.
B. Itemize tasks for approval.
C. Reduce repetitive tasks.
D. Minimize setup complexity.
E. Define a security strategy.
F. Generate reports and metrics.
Show Answer
Correct Answer: C, F
Explanation: SOAR (Security Orchestration, Automation, and Response) improves security operations by automating repetitive workflows, reducing manual effort, and producing operational reports and metrics for visibility and performance tracking. It does not inherently minimize security attacks, simplify setup, define an organization's security strategy, or merely itemize tasks for approval.
Question 182
The security team reviews a web server for XSS and runs the following Nmap scan:
Which of the following most accurately describes the result of the scan?
A. An output of characters > and " as the parameters used in the attempt
B. The vulnerable parameter ID http://172.31.15.2/1.php?id=2 and unfiltered characters returned
C. The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe
D. The vulnerable parameter id=2 with a SQL injection attempt
Show Answer
Correct Answer: C
Explanation: The Nmap XSS-related scan result indicates the vulnerable parameter and reports that unsafe characters such as > and " were reflected without proper filtering/escaping, which is characteristic of a potential reflected XSS finding. It is not a SQL injection result. Option C best matches this description because it identifies the vulnerable parameter and the unsafe characters involved.
Question 183
A cybersecurity analyst is setting up a security control that monitors network traffic and produces an active response to a security event. Which of the following tools is the analyst configuring?
A. EDR
B. IPS
C. CASB
D. WAF
Show Answer
Correct Answer: B
Explanation: An Intrusion Prevention System (IPS) monitors network traffic inline and provides an active response to detected threats by blocking, dropping, or resetting malicious traffic. EDR focuses on endpoint detection and response, CASB secures access to cloud services, and WAF protects web applications by filtering HTTP(S) traffic rather than serving as the general network traffic prevention control described.
Question 184
A security analyst has identified outgoing network traffic leaving the enterprise at odd times. The traffic appears to pivot across network segments and target domain servers. The traffic is then routed to a geographic location to which the company has no association. Which of the following best describes this type of threat?
A. Hacktivist
B. Zombie
C. Insider threat
D. Nation-state actor
Show Answer
Correct Answer: D
Explanation: The described activity—stealthy outbound traffic at unusual times, lateral movement across network segments, targeting domain controllers/servers, and exfiltration to a foreign geographic location—is most consistent with an advanced persistent threat typically associated with a nation-state actor. A zombie is a compromised host, not a threat actor classification, while hacktivists usually seek disruption or publicity and an insider threat originates from an authorized individual within the organization.
Question 185
An XSS vulnerability was reported on one of the public websites of a company. The security department confirmed the finding and needs to provide a recommendation to the application owner. Which of the following recommendations will best prevent this vulnerability from being exploited? (Choose two.)
A. Implement an IPS in front of the web server.
B. Enable MFA on the website.
C. Take the website offline until it is patched.
D. Implement a compensating control in the source code.
E. Configure TLS v1.3 on the website.
F. Fix the vulnerability using a virtual patch at the WA
Show Answer
Correct Answer: D, F
Explanation: The best recommendations are to remediate the application by implementing compensating controls in the source code (such as proper output encoding, input validation, or sanitization) and to deploy a virtual patch at the web application firewall (WAF) to block known XSS exploit attempts until the application is fully fixed. An IPS is not application-aware enough to reliably prevent XSS, MFA and TLS do not address XSS, and taking the site offline is a drastic operational measure rather than the best security recommendation.
Question 186
An analyst is investigating a phishing incident and has retrieved the following as part of the investigation:
cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -
EncodedCommand
A. Echo the command payload content into ‘base64 -d‘.
B. Execute the command from a Windows VM.
C. Use a command console with administrator privileges to execute the code.
D. Run the command as an unprivileged user from the analyst workstation.
Show Answer
Correct Answer: A
Explanation: The PowerShell command uses the -EncodedCommand parameter, which indicates the payload is Base64-encoded (typically UTF-16LE in PowerShell). The safest first step is to decode the payload to inspect the script statically rather than executing potentially malicious code. Running the command, even in a VM, is a later dynamic-analysis step, while executing it on a workstation or with elevated privileges is inappropriate.
Question 187
An employee received a phishing email that contained malware targeting the company. Which of the following is the best way for a security analyst to get more details about the malware and avoid disclosing information?
A. Upload the malware to the VirusTotal website.
B. Share the malware with the EDR provider.
C. Hire an external consultant to perform the analysis.
D. Use a local sandbox in a microsegmented environment.
Show Answer
Correct Answer: D
Explanation: A local sandbox in a microsegmented environment allows the analyst to safely execute and observe the malware's behavior while keeping the sample and any potentially sensitive company information inside the organization's controlled environment. Uploading to a public service like VirusTotal or sharing externally may disclose indicators or proprietary information, and hiring a consultant is not the best immediate technical method for safe malware analysis.
Question 188
Several critical bugs were identified during a vulnerability scan. The SLA risk requirement is that all critical vulnerabilities should be patched within 24 hours. After sending a notification to the asset owners, the patch cannot be deployed due to planned, routine system upgrades. Which of the following is the best method to remediate the bugs?
A. Reschedule the upgrade and deploy the patch.
B. Request an exception to exclude the patch from installation.
C. Update the risk register and request a change to the SLA.
D. Notify the incident response team and rerun the vulnerability scan.
Show Answer
Correct Answer: A
Explanation: The organization has a defined requirement that all critical vulnerabilities must be patched within 24 hours. Planned routine upgrades do not outweigh a critical security SLA. The appropriate remediation is to prioritize deployment of the security patch by rescheduling the routine upgrade if necessary. Requesting an exception or changing the SLA weakens the control rather than remediating the risk, and notifying the incident response team or simply rescanning does not fix the vulnerability.
Question 189
Which of the following will most likely cause severe issues with authentication and logging?
A. Virtualization
B. Multifactor authentication
C. Federation
D. Time synchronization
Show Answer
Correct Answer: D
Explanation: Time synchronization is critical for both authentication and logging. Authentication mechanisms such as Kerberos rely on closely synchronized clocks to validate tickets and prevent replay attacks. Unsynchronized time can cause authentication failures. Logging also depends on accurate timestamps across systems to correlate events and reconstruct incident timelines; clock drift makes logs unreliable.
Question 190
A manufacturing company’s assembly line machinery only functions on an end-of-life OS. Consequently, no patches exist for several highly exploitable OS vulnerabilities. Which of the following is the best mitigating control to reduce the risk of these current conditions?
A. Enforce strict network segmentation to isolate vulnerable systems from the production network.
B. Increase the system resources for vulnerable devices to prevent denial of service.
C. Perform penetration testing to verify the exploitability of these vulnerabilities.
D. Develop in-house patches to address these vulnerabilities.
Show Answer
Correct Answer: A
Explanation: When legacy systems must remain on an end-of-life operating system and cannot be patched, the most effective compensating control is to isolate them through strict network segmentation. This reduces the attack surface and limits lateral movement if the system is compromised. Increasing system resources does not address security vulnerabilities, penetration testing only assesses risk without mitigating it, and developing in-house OS patches is generally impractical and unreliable for an unsupported operating system.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.