A user is suspected of violating policy by logging in to a Linux VM during non-business hours. Which of the following system files is the best way to track the user’s activities?
A. /var/log/secure
B. /etc/motd
C. /var/log/messages
D. /etc/passwd
Show Answer
Correct Answer: A
Explanation: /var/log/secure records authentication-related events on many Linux distributions, including SSH logins, authentication attempts, and sudo usage. It is the primary log to review for determining whether a user logged in during non-business hours. /etc/motd is only the login message, /var/log/messages contains general system messages, and /etc/passwd stores user account information rather than activity logs.
Question 133
A junior security analyst opened ports on the company’s firewall, and the company experienced a data breach. Which of the following most likely caused the data breach?
A. Environmental hacktivist
B. Accidental insider threat
C. Nation-state
D. Organized crime group
Show Answer
Correct Answer: B
Explanation: The junior security analyst is an authorized internal user whose mistaken firewall configuration (opening ports) enabled the breach. This is an accidental insider threat: an unintentional action by an insider that creates a security vulnerability leading to compromise. The other options describe potential external threat actors that might exploit the vulnerability, not the most likely cause described in the scenario.
Question 134
A security analyst needs to block vulnerable ports and disable legacy protocols. The analyst has ensured NetBIOS trio, Telnet, SMB, and TFTP are blocked and/or disabled. Which of the following additional protocols should the analyst block next?
A. LDAPS v3
B. SNMP v1
C. TLS 1.3
D. Kerberos v5
Show Answer
Correct Answer: B
Explanation: SNMPv1 is a legacy, insecure protocol that uses weak/plaintext community-string authentication and should be disabled in favor of SNMPv3. The other options are current secure or required protocols: LDAPS, TLS 1.3, and Kerberos v5 are not legacy protocols that should generally be blocked.
Question 135
A network security analyst for a large company noticed unusual network activity on a critical system. Which of the following tools should the analyst use to analyze network traffic to search for malicious activity?
A. WAF
B. Wireshark
C. EDR
D. Nmap
Show Answer
Correct Answer: B
Explanation: Wireshark is a packet capture and protocol analysis tool used to inspect network traffic in detail and identify suspicious or malicious activity. A WAF protects web applications, EDR focuses on endpoint detection and response, and Nmap is primarily used for network discovery and port scanning.
Question 136
HOTSPOT
-
A systems administrator is reviewing the output of a vulnerability scan.
INSTRUCTIONS
-
Review the information in each tab.
Based on the organization’s environment architecture and remediation standards, select the server to be patched within 14 days and select the appropriate technique and mitigation.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Show Answer
Correct Answer: Server: 192.168.60.5
Technique/Mitigation: Patch; upload signed certificate from trusted third-party provider
Explanation: The 14-day remediation window applies to CVSS >7.9 and <9.0 in the production environment. The CVSS 8.1 untrusted X.509 certificate finding affects 192.168.60.5 in production, and the appropriate remediation is replacing the untrusted certificate with one signed by a trusted CA.
Question 138
A security analyst needs to support an organization’s legal case against a threat actor. Which of the following processes provides the best way to assist in the prosecution of the case?
A. Chain of custody
B. Evidence gathering
C. Securing the scene
D. Forensic analysis
Show Answer
Correct Answer: A
Explanation: Chain of custody is the process that best supports prosecution because it preserves and documents the integrity, handling, and ownership of evidence from collection through presentation in court. Proper chain of custody is essential for evidence to be admissible and defensible in legal proceedings. Evidence gathering, securing the scene, and forensic analysis are important investigative activities, but without a documented chain of custody, the evidence may be challenged or excluded.
Question 139
A user clicks on a malicious adware link, and the malware successfully downloads to the machine. The malware has a script that invokes command-and-control activity. Which of the following actions is the best way to contain the incident without any additional impact?
A. Disable the user account until the malware investigation is complete.
B. Review EDR information to determine whether the file was detected and quarantined locally.
C. Block the server on the proxy and firewall.
D. Submit a recategorization update to the vendor.
Show Answer
Correct Answer: C
Explanation: The malware is already installed and attempting command-and-control communication. The primary containment goal is to prevent further attacker interaction and additional payloads or data exfiltration. Blocking the malicious C2 server at the proxy and firewall disrupts communication with minimal additional impact. Disabling the user account does not stop the malware, reviewing EDR is a detection/verification step rather than containment, and recategorizing the site is a longer-term preventive action, not immediate incident containment.
Question 140
Which of the following should be performed first when creating a BCP to ensure that all critical functions and financial implications have been considered?
A. Failover test
B. Tabletop exercise
C. Security policies
D. Business impact analysis
Show Answer
Correct Answer: D
Explanation: A Business Impact Analysis (BIA) is the foundational step in business continuity planning. It identifies critical business functions, dependencies, recovery priorities, and the operational and financial impact of disruptions. This information guides the rest of the BCP. Failover tests and tabletop exercises occur later to validate the plan, and security policies are broader governance documents rather than the first step in creating a BCP.
Question 141
Which of the following responsibilities does the legal team have during an incident management event? (Choose two).
A. Coordinate additional or temporary staffing for recovery efforts.
B. Review and approve new contracts acquired as a result of an event.
C. Advise the incident response team on matters related to regulatory reporting.
D. Ensure all system security devices and procedures are in place.
E. Conduct computer and network damage assessments for insurance.
F. Verify that all security personnel have the appropriate clearances.
Show Answer
Correct Answer: B, C
Explanation: The legal team's responsibilities during incident management include advising the incident response team on legal and regulatory obligations, including breach notification and reporting requirements, and reviewing or approving legal agreements such as new contracts that may be required as a result of the incident. The other options align with HR (staffing, clearances) or security/technical teams (security controls, damage assessments).
Question 142
In the last hour, a high volume of failed RDP authentication attempts has been logged on a critical server. All of the authentication attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following mitigating controls would be most effective to reduce the rate of success of this brute-force attack? (Choose two.)
A. Increase the granularity of log-on event auditing on all devices.
B. Enable host firewall rules to block all outbound traffic to TCP port 3389.
C. Configure user account lockout after a limited number of failed attempts.
D. Implement a firewall block for the IP address of the remote system.
E. Install a third-party remote access tool and disable RDP on all devices.
F. Block inbound to TCP port 3389 from untrusted remote IP addresses at the perimeter firewall.
Show Answer
Correct Answer: C, F
Explanation: Configuring account lockout limits repeated password guesses against the valid account, reducing the chance of a successful brute-force attack. Restricting inbound RDP (TCP 3389) at the perimeter firewall to trusted IP addresses prevents untrusted remote hosts from attempting RDP authentication in the first place. The other options are either monitoring only, target the wrong traffic direction, are overly disruptive, or are less effective as a general mitigating control.
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
