A Chief Finance Officer receives an email from someone who is possibly impersonating the company’s Chief Executive Officer and requesting a financial operation. Which of the following should an analyst use to verify whether the email is an impersonation attempt?
A. PKI
B. MFA
C. SMTP
D. DKIM
Show Answer
Correct Answer: D
Explanation: DKIM (DomainKeys Identified Mail) allows an analyst to verify whether an email was authorized by the sender’s domain and whether its contents were altered in transit, making it a key control for detecting email spoofing or impersonation. PKI and MFA are not email verification mechanisms, and SMTP is merely the mail transport protocol.
Question 167
SIMULATION
-
An organization’s website was maliciously altered.
INSTRUCTIONS
-
Review information in each tab to select the source IP the analyst should be concerned about, the indicator of compromise, and the two appropriate corrective actions.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Show Answer
Correct Answer: Source IP of concern:
41.21.18.102
Indicator of compromise:
Modified index.html file
Corrective actions:
Change the password on the sjames account
Block external SFTP access
Explanation: The SFTP logs show an external IP (41.21.18.102) successfully authenticating as sjames and writing index.html, directly aligning with a malicious website alteration. Other IPs either access content normally or show minor, non-repeated failures. Securing the compromised account and restricting external SFTP reduces further unauthorized modifications.
Question 168
A newly hired security manager in a SOC wants to improve efficiency by automating routine tasks. Which of the following SOC tasks is most suitable for automation?
A. Conducting security assessments and audits of IT systems
B. Investigating security incidents and determining the root causes
C. Reviewing logs and alerts to identify security threats and anomalies
D. Generating incident reports and notifying the appropriate stakeholders
Show Answer
Correct Answer: C
Explanation: Reviewing logs and alerts to identify security threats is highly repetitive, data-driven, and well supported by SIEM and SOAR technologies, making it the most suitable SOC task for automation. Tasks like investigations, audits, and root-cause analysis require deeper human judgment and contextual understanding, while reporting often still needs human review and customization.
Question 169
A Chief Information Security Officer wants to lock down the users’ ability to change applications that are installed on their Windows systems. Which of the following is the best enterprise-level solution?
A. HIPS
B. GPO
C. Registry
D. DLP
Show Answer
Correct Answer: B
Explanation: Group Policy Objects (GPOs) provide centralized, enterprise-level control over Windows systems through Active Directory. They can restrict software installation, prevent application changes, and enforce user permissions across all domain-joined machines, making them the most effective solution compared to host-based tools, registry edits, or data-focused controls.
Question 170
An end user forwarded an email with a file attachment to the SOC for review. The SOC analysts think the file was specially crafted for the target. Which of the following investigative actions would best determine if the attachment was malicious?
A. Review the file in Virus Total to determine if the domain is associated with any phishing.
B. Review the email header to analyze the DKIM, DMARC, and SPF values.
C. Review the source IP address in AbuseIPDB.
D. Review the attachment’s behavior in a sandbox environment while running Wireshark.
Show Answer
Correct Answer: D
Explanation: If the attachment was specially crafted for a specific target, static reputation-based checks (VirusTotal, AbuseIPDB) and email authentication reviews (SPF/DKIM/DMARC) may not reveal maliciousness. The most effective way to determine if the attachment itself is malicious is to execute it in a controlled sandbox and observe its behavior, including process activity, file system changes, and network traffic (e.g., via Wireshark). Behavioral analysis directly reveals malicious actions regardless of prior signatures or sender reputation.
Question 171
A security analyst reviews the following results of a Nikto scan:
Which of the following should the security administrator investigate next?
A. tiki
B. phpList
C. shtml.exe
D. sshome
Show Answer
Correct Answer: B
Explanation: The Nikto finding for phpList indicates known vulnerabilities including remote administrative access. Unauthorized admin access presents an immediate, high-impact risk that can lead to data compromise and further exploitation, making phpList the highest priority to investigate compared to the other findings.
Question 172
An organization plans to use an advanced machine-learning tool as a central collection server. The tool will perform data aggregation and analysis. Which of the following should the organization implement?
A. SIEM
B. Firewalls
C. Syslog server
D. Flow analysis
Show Answer
Correct Answer: A
Explanation: A Security Information and Event Management (SIEM) system is designed as a central collection server that aggregates data from many sources and performs advanced analysis, often using machine learning and correlation to detect patterns and threats. Firewalls enforce traffic rules, syslog servers primarily collect logs without advanced analytics, and flow analysis focuses on network traffic patterns rather than broad data aggregation and ML-based analysis.
Question 173
A company’s internet-facing web application has been compromised several times due to identified design flaws. The company would like to minimize the risk of these incidents from reoccurring and has provided the developers with better security training. However, the company cannot allocate any more internal resources to the issue. Which of the following are the best options to help identify flaws within the system? (Choose two.)
A. Deploying a WAF
B. Performing a forensic analysis
C. Contracting a penetration test
D. Holding a tabletop exercise
E. Creating a bug bounty program
F. Implementing threat modeling
Show Answer
Correct Answer: C, E
Explanation: The goal is to identify design and security flaws while minimizing the use of internal resources. Contracting a penetration test brings in external experts to actively test the application for vulnerabilities without requiring internal staffing (C). Creating a bug bounty program leverages external researchers to continuously identify flaws, again with minimal internal resource commitment (E). Other options either focus on response rather than identification, require internal effort, or do not directly uncover design flaws.
Question 174
A web application has a function to retrieve content from an internal URL to identify CSRF attacks in the logs. The security analyst is building a regular expression that will filter out the correctly formatted requests. The target URL is https://10.1.2.3/api, and the receiving API only accepts GET requests and uses a single integer argument named “id.” Which of the following regular expressions should the analyst use to achieve the objective?
A. ^(?!https://10\.1\.2\.3/api\?id=[0-9]+)
B. ^https://10\.1\.2\.3/api\?id=\d+
C. (?:^https://10\.1\.2\.3/api\?id=[0-9]+)
D. ^https://10\.1\.2\.3/api\?id=[0-9]+$
Show Answer
Correct Answer: D
Explanation: The goal is to match only correctly formatted requests to the internal API. The correct URL must start with the exact scheme, IP, and path, include a single integer parameter id, and contain nothing extra. Option D anchors the pattern at both the beginning (^) and end ($) of the string and matches https://10.1.2.3/api?id= followed by one or more digits. Other options either lack proper anchoring, allow extra characters, or use a negative lookahead that would exclude valid requests. Therefore, D is the correct regular expression.
Question 175
Which of the following is instituting a security policy that users must lock their systems when stepping away from their desks an example of?
A. Configuration management
B. Compensating control
C. Awareness, education, and training
D. Administrative control
Show Answer
Correct Answer: D
Explanation: Instituting a requirement that users lock their systems when stepping away is the creation of a formal rule governing user behavior. Policies, procedures, and rules are administrative controls. Awareness, education, and training would involve teaching or reminding users how or why to comply, not defining the policy itself.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
