During normal security monitoring activities, the following activity was observed:
cd C:\Users\Documents\HR\Employees
takeown/f .*
SUCCESS:
Which of the following best describes the potentially malicious activity observed?
A. Registry changes or anomalies
B. Data exfiltration
C. Unauthorized privileges
D. File configuration changes
Show Answer
Correct Answer: C
Explanation: The command `takeown /f .*` is used to take ownership of files in a directory on a Windows system. Taking ownership allows a user to override existing access controls and potentially grant themselves full permissions to sensitive files. Observing this in the HR Employees directory indicates an attempt to gain or escalate file ownership and access rights beyond what is normally authorized, which best fits unauthorized privileges rather than registry changes, data exfiltration, or routine configuration changes.
Question 157
An analyst would like to start automatically ingesting IoCs into the EDR tool. Which of the following sources would be the most cost effective for the analyst to use?
A. Government bulletins
B. Social media
C. Dark web
D. Blogs
Show Answer
Correct Answer: A
Explanation: Government bulletins (e.g., CERTs, CISA, NCSC) provide vetted Indicators of Compromise for free, often in structured formats suitable for automation. Other sources like social media, dark web, or blogs either require significant effort to curate, introduce reliability risks, or incur costs, making government bulletins the most cost-effective option.
Question 158
A SOC analyst observes reconnaissance activity from an IP address. The activity follows a pattern of short bursts toward a low number of targets. An open-source review shows that the IP has a bad reputation. The perimeter firewall logs indicate the inbound traffic was allowed. The destination hosts are high-value assets with EDR agents installed. Which of the following is the best action for the SOC to take to protect against any further activity from the source IP?
A. Add the IP address to the EDR deny list.
B. Create a SIEM signature to trigger on any activity from the source IP subnet detected by the web proxy or firewalls for immediate notification.
C. Implement a prevention policy for the IP on the WAF.
D. Activate the scan signatures for the IP on the NGFWs.
Show Answer
Correct Answer: D
Explanation: The activity observed is reconnaissance/scanning from a known-bad IP that is currently allowed through the perimeter. The most effective way to protect against any further activity is to stop it at the network edge. Activating scan/signature-based prevention on the NGFW allows detection and blocking of reconnaissance behavior from that source before it reaches internal assets. SIEM alerting is reactive, EDR deny lists only protect endpoints after traffic arrives, and a WAF is limited to web traffic only.
Question 159
A company is launching a new application in its internal network, where internal customers can communicate with the service desk. The security team needs to ensure the application will be able to handle unexpected strings with anomalous formats without crashing. Which of the following processes is the most applicable for testing the application to find how it would behave in such a situation?
A. Fuzzing
B. Coding review
C. Debugging
D. Static analysis
Show Answer
Correct Answer: A
Explanation: Fuzzing intentionally feeds an application with unexpected, malformed, or random inputs to observe how it behaves under anomalous conditions. This directly tests whether the application can handle unusual strings without crashing, which is the stated security concern. Code review, debugging, and static analysis do not actively test runtime behavior with malformed inputs.
Question 160
A security audit for unsecured network services was conducted, and the following output was generated:
Which of the following services should the security team investigate further? (Choose two.)
A. 21
B. 22
C. 23
D. 636
E. 1723
F. 3389
Show Answer
Correct Answer: C, E
Explanation: Port 23 runs Telnet, which transmits credentials and data in cleartext and is inherently insecure compared to SSH. Port 1723 is used by PPTP, a VPN protocol known to rely on weak encryption and outdated authentication (e.g., MS-CHAP), making it vulnerable to interception and cryptographic attacks. Both services warrant further security investigation.
Question 161
An organization identifies a method to detect unexpected behavior, crashes, or resource leaks in a system by feeding invalid, unexpected, or random data to stress the application. Which of the following best describes this testing methodology?
A. Reverse engineering
B. Static
C. Fuzzing
D. Debugging
Show Answer
Correct Answer: C
Explanation: The methodology described involves supplying invalid, unexpected, or random inputs to a system to uncover crashes, unexpected behavior, or resource leaks. This is the defining characteristic of fuzz testing (fuzzing). Reverse engineering analyzes existing systems, static testing examines code without execution, and debugging focuses on diagnosing known issues rather than proactively stressing inputs.
Question 162
An analyst is trying to capture anomalous traffic from a compromised host. Which of the following are the best tools for achieving this objective? (Choose two.)
A. tcpdump
B. SIEM
C. Vulnerability scanner
D. Wireshark
E. Nmap
F. SOAR
Show Answer
Correct Answer: A, D
Explanation: To capture anomalous traffic from a compromised host, packet capture and analysis tools are required. tcpdump captures raw network packets directly from interfaces, making it suitable for collecting traffic for analysis. Wireshark provides deep packet inspection and visualization to analyze captured traffic. The other options focus on logging, automation, scanning, or orchestration rather than direct traffic capture.
Question 163
The SOC receives a number of complaints regarding a recent uptick in desktop error messages that are associated with workstation access to an internal web application. An analyst, identifying a recently modified XML file on the web server, retrieves a copy of this file for review, which contains the following code:
Which of the following XML schema constraints would stop these desktop error messages from appearing?
A.
B.
C.
D.
Show Answer
Correct Answer: B
Explanation: The desktop errors are consistent with malformed or malicious input being processed by the web application. An XML schema constraint that enforces a strict pattern—such as allowing only alphanumeric characters via a regular expression—would prevent special characters from being accepted. This stops script injection or invalid characters from reaching the application, eliminating the associated error messages.
Question 164
Which of the following is most appropriate to use with SOAR when the security team would like to automate actions across different vendor platforms?
A. STIX/TAXII
B. APIs
C. Data enrichment
D. Threat feed
Show Answer
Correct Answer: B
Explanation: SOAR platforms automate and orchestrate actions across multiple security tools from different vendors. This requires direct, programmatic interaction with those tools, which is achieved through APIs. APIs allow SOAR to execute actions such as blocking IPs, disabling accounts, or updating configurations across disparate platforms. STIX/TAXII are standards for sharing threat intelligence, not for performing automated actions, while data enrichment and threat feeds support analysis rather than orchestration.
Question 165
An analyst is creating the final vulnerability report for one of the company’s customers. The customer asks for a scanning profile with a CVSS score of 7 or higher. The analyst has confirmed there is no finding for missing database patches, even if false positives have been eliminated by manual checks. Which of the following is the most probable reason for the missing scan result?
A. The server was offline at the moment of the scan.
B. The system was not patched appropriately before the scan.
C. The scan finding does not match the requirement.
D. The output of the scan is corrupted.
Show Answer
Correct Answer: C
Explanation: The scan was filtered to only include findings with a CVSS score of 7 or higher. Since the scan ran successfully and manual checks ruled out false positives, the most probable reason for the missing database patch finding is that any existing issues did not meet the CVSS ≥7 threshold and were therefore excluded by the scanning profile, rather than a scan failure or corrupted output.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.