A security analyst needs to develop a solution to protect a high-value asset from an exploit like a recent zero-day attack. Which of the following best describes this risk management strategy?
A. Avoid
B. Transfer
C. Accept
D. Mitigate
Show Answer
Correct Answer: D
Explanation: Developing and implementing a solution to protect a high-value asset reduces the likelihood or impact of exploitation. That is risk mitigation. Avoidance would eliminate the risky activity, transfer would shift the risk to another party (such as through insurance or outsourcing), and acceptance means consciously taking no additional action.
Question 202
SIMULATION
-
An organization has noticed large amounts of data are being sent out of its network. An analyst is identifying the cause of the data exfiltration.
INSTRUCTIONS
-
Select the command that generated the output in tabs 1 and 2.
Review the output text in all tabs and identify the file responsible for the malicious behavior.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Explanation: Tab 1 shows active network connections with executable names, matching netstat -bo. Tab 2 lists running processes and memory usage, matching tasklist. Comparing MD5 hashes in tabs 3 and 4 shows cmd.exe is the only listed file whose hash differs from the baseline, indicating it has been modified and is responsible for the malicious behavior.
Question 203
A security analyst needs to identify an asset that should be remediated based on the following information:
Which of the following assets should the analyst remediate first?
A. Mail server
B. Domain controller
C. Web server
D. File server
Show Answer
Correct Answer: C
Explanation: The web server should be remediated first because it is described as having the highest practical exploitation risk: it is publicly exposed, requires no privileges (PR:N), and has low attack complexity, making it the most likely target for immediate exploitation. Prioritization should consider exploitability and exposure, not just asset criticality.
Question 204
Which of the following characteristics ensures the security of an automated information system is the most effective and economical?
A. Originally designed to provide necessary security
B. Subjected to intense security testing
C. Customized to meet specific security threats
D. Optimized prior to the addition of security
Show Answer
Correct Answer: A
Explanation: The most effective and economical way to ensure security is to build it into the system from the outset (security by design). Designing the system with required security controls from the beginning avoids expensive retrofits, reduces architectural weaknesses, and is a fundamental information security principle. Security testing is important but cannot compensate for poor design; customizing to threats is useful but follows secure design; optimizing before adding security implies security is an afterthought.
Question 205
Which of the following is the best metric to use when reviewing and addressing findings that caused an incident?
A. Mean time to restore
B. Mean time to respond
C. Mean time to remediate
D. Mean time to detect
Show Answer
Correct Answer: C
Explanation: Mean time to remediate measures the average time required to fully fix the underlying issue or finding after it has been identified. Since the question focuses on reviewing and addressing findings that caused an incident, remediation time is the most appropriate metric. Mean time to restore measures service recovery, mean time to respond measures initial response, and mean time to detect measures discovery speed.
Question 206
During a packet capture review, a security analyst identifies the output below as suspicious:
Which of the following best describes the type of activity the analyst has identified?
A. Ping sweep
B. Port scan
C. DoS attack
D. Beaconing
Show Answer
Correct Answer: D
Explanation: The described activity is best identified as beaconing: periodic, repeated network communications from a host to the same destination are characteristic of command-and-control check-ins. A ping sweep probes multiple hosts with ICMP, a port scan probes ports on one or more hosts, and a DoS attack is characterized by overwhelming traffic rather than regular callbacks.
Question 207
During normal security monitoring activities, the following activity was observed:
cd C:\Users\Documents\HR\Employees
takeown/f .*
SUCCESS:
Which of the following best describes the potentially malicious activity observed?
A. Registry changes or anomalies
B. Data exfiltration
C. Unauthorized privileges
D. File configuration changes
Show Answer
Correct Answer: C
Explanation: The command `takeown /f .*` is used to take ownership of files in the current directory. Taking ownership changes security ownership/permissions and is commonly associated with gaining access to files that the current user otherwise could not manage. In a security monitoring context, this is best described as an attempt to obtain or exercise unauthorized privileges rather than data exfiltration, registry modification, or general file configuration changes.
Question 208
An analyst would like to start automatically ingesting IoCs into the EDR tool. Which of the following sources would be the most cost effective for the analyst to use?
A. Government bulletins
B. Social media
C. Dark web
D. Blogs
Show Answer
Correct Answer: A
Explanation: Government bulletins are generally the most cost-effective source because they are typically free, curated, and often provide structured, machine-readable threat intelligence (such as STIX/TAXII feeds) suitable for automated IoC ingestion into EDR platforms. Social media, dark web sources, and blogs tend to require more validation, produce more noise, or incur additional collection costs.
Question 209
A SOC analyst observes reconnaissance activity from an IP address. The activity follows a pattern of short bursts toward a low number of targets. An open-source review shows that the IP has a bad reputation. The perimeter firewall logs indicate the inbound traffic was allowed. The destination hosts are high-value assets with EDR agents installed. Which of the following is the best action for the SOC to take to protect against any further activity from the source IP?
A. Add the IP address to the EDR deny list.
B. Create a SIEM signature to trigger on any activity from the source IP subnet detected by the web proxy or firewalls for immediate notification.
C. Implement a prevention policy for the IP on the WAF.
D. Activate the scan signatures for the IP on the NGFWs.
Show Answer
Correct Answer: D
Explanation: The goal is to protect against further activity from a known malicious source IP that is already reaching the perimeter. Enabling scan/intrusion prevention signatures on the NGFW provides network-level detection and prevention of reconnaissance before it reaches internal assets. An EDR deny list only protects managed endpoints, a SIEM rule is alerting rather than prevention, and a WAF only applies to web application traffic.
Question 210
A company is launching a new application in its internal network, where internal customers can communicate with the service desk. The security team needs to ensure the application will be able to handle unexpected strings with anomalous formats without crashing. Which of the following processes is the most applicable for testing the application to find how it would behave in such a situation?
A. Fuzzing
B. Coding review
C. Debugging
D. Static analysis
Show Answer
Correct Answer: A
Explanation: Fuzzing is specifically designed to test software robustness by supplying malformed, unexpected, or random inputs to identify crashes, hangs, and input-handling vulnerabilities. Code review, debugging, and static analysis do not dynamically exercise the application with anomalous input in this way.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
