A new SOC manager reviewed findings regarding the strengths and weaknesses of the last tabletop exercise in order to make improvements. Which of the following should the SOC manager utilize to improve the process?
A. The most recent audit report
B. The incident response playbook
C. The incident response plan
D. The lessons-learned register
Show Answer
Correct Answer: D
Explanation: Tabletop exercises generate findings about what worked and what did not. Those observations are formally captured in the lessons-learned register, which is specifically used to analyze strengths and weaknesses and drive improvements to incident response processes, procedures, and training. Audit reports, playbooks, and plans are updated as outputs of lessons learned, not the primary input for improvement.
Question 147
A security analyst needs to identify services in a small, critical infrastructure ICS network. Many components in the network are likely to break if they receive malformed or unusually large requests. Which of the following is the safest method to use when identifying service versions?
A. Use nmap -sV to identify all assets on the network.
B. Use Burp Suite to conduct service identification.
C. Use nc to manually perform banner grabbing.
D. Use Nessus with restricted concurrent connections.
Show Answer
Correct Answer: C
Explanation: In fragile ICS environments, the primary concern is avoiding any malformed, excessive, or intrusive traffic that could disrupt devices. Manual banner grabbing with netcat (nc) allows the analyst to send minimal, fully controlled input—often just opening a TCP connection and reading the banner—making it the lowest‑risk approach. Automated tools like nmap, Burp Suite, or Nessus, even when throttled, still generate multiple probes and payloads that may destabilize sensitive ICS components.
Question 148
A user’s computer is performing slower than the day before, and unexpected windows continually open and close. The user did not install any new programs, and after the user restarted the desktop, the issue was not resolved. Which of the following incident response actions should be taken next?
A. Restart in safe mode and start a virus scan.
B. Disconnect from the network and leave the PC turned on.
C. Contain the device and implement a legal hold.
D. Reformat and reimage the OS.
Show Answer
Correct Answer: B
Explanation: The symptoms indicate a likely malware infection. The correct next incident response step is containment: disconnect the system from the network to prevent further spread or data exfiltration while leaving it powered on to preserve volatile evidence for forensic analysis. Other options either risk destroying evidence (safe mode scan, reimage) or are premature (legal hold).
Question 149
Which of following attack methodology frameworks should a cybersecurity analyst use to identify similar TTPs utilized by nation-state actors?
A. Cyber kill chains
B. Diamond Model of Intrusion Analysis
C. OWASP Testing Guide
D. MITRE ATT&CK matrix
Show Answer
Correct Answer: D
Explanation: MITRE ATT&CK is specifically designed to catalog and map adversary Tactics, Techniques, and Procedures (TTPs), including those used by nation-state actors, enabling analysts to identify and compare similar behaviors across campaigns.
Question 150
A security analyst needs to develop a solution to protect a high-value asset from an exploit like a recent zero-day attack. Which of the following best describes this risk management strategy?
A. Avoid
B. Transfer
C. Accept
D. Mitigate
Show Answer
Correct Answer: D
Explanation: Developing a solution to protect a high-value asset from exploitation means implementing controls to reduce the likelihood or impact of the risk. This is the definition of risk mitigation. Avoidance would eliminate the activity entirely, transfer would shift the risk to another party, and acceptance would take no action.
Question 151
SIMULATION
-
An organization has noticed large amounts of data are being sent out of its network. An analyst is identifying the cause of the data exfiltration.
INSTRUCTIONS
-
Select the command that generated the output in tabs 1 and 2.
Review the output text in all tabs and identify the file responsible for the malicious behavior.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Explanation: Tab 1 shows active network connections with states and associated process names/PIDs, which matches netstat -bo. Tab 2 lists running processes with PID, session, and memory usage, which matches tasklist. Comparing file hashes, cmd.exe differs from the baseline while others match, indicating cmd.exe was modified and is responsible for the malicious activity.
Question 152
A security analyst needs to identify an asset that should be remediated based on the following information:
Which of the following assets should the analyst remediate first?
A. Mail server
B. Domain controller
C. Web server
D. File server
Show Answer
Correct Answer: C
Explanation: The web server should be remediated first because it is public-facing and has low attack complexity, making it the most easily exploitable asset. Assets exposed to the internet with low barriers to exploitation present the highest immediate risk and are prioritized over internal systems like mail servers, domain controllers, or file servers that are not directly accessible.
Question 153
Which of the following characteristics ensures the security of an automated information system is the most effective and economical?
A. Originally designed to provide necessary security
B. Subjected to intense security testing
C. Customized to meet specific security threats
D. Optimized prior to the addition of security
Show Answer
Correct Answer: A
Explanation: Security is most effective and economical when it is built into the system from the outset. Designing security in from the beginning avoids costly retrofits, reduces inherent vulnerabilities, and ensures controls align with system architecture. Testing, customization, or optimization after the fact cannot match the effectiveness or cost efficiency of security by design.
Question 154
Which of the following is the best metric to use when reviewing and addressing findings that caused an incident?
A. Mean time to restore
B. Mean time to respond
C. Mean time to remediate
D. Mean time to detect
Show Answer
Correct Answer: C
Explanation: The goal when reviewing and addressing findings that caused an incident is to measure how long it takes to fully fix the underlying issue so it does not recur. Mean Time to Remediate captures the duration from identifying the root cause through implementing a permanent fix. The other metrics focus on detection, initial response, or service restoration rather than complete remediation.
Question 155
During a packet capture review, a security analyst identifies the output below as suspicious:
Which of the following best describes the type of activity the analyst has identified?
A. Ping sweep
B. Port scan
C. DoS attack
D. Beaconing
Show Answer
Correct Answer: D
Explanation: Beaconing describes periodic, regular network communications from a host to an external system, often seen in command-and-control (C2) activity. In packet captures, this appears as consistent, repeated connections at fixed intervals, which distinguishes it from ping sweeps, port scans, or denial-of-service patterns.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
