A security analyst observes a high volume of SYN flags from an unexpected source toward a web application server within one hour. The traffic is not flagging for any exploit signatures.
Which of the following scenarios best describes this activity?
A. A legitimate connection is continuously attempting to establish a connection with a downed web server.
B. A script kiddie is attempting to execute a DDoS through a ping flood attack.
C. An attacker is executing reconnaissance activities by mapping which ports are open and closed.
D. A web exploit attempt is likely occurring and the security analyst is not seeing it.
Show Answer
Correct Answer: C
Explanation: A high volume of SYN packets without exploit signatures is most consistent with a TCP SYN scan, a reconnaissance technique used to identify open, closed, or filtered ports. A legitimate client repeatedly trying to connect to a down server would typically target a known service rather than broadly probing, a ping flood uses ICMP rather than TCP SYN flags, and the lack of exploit signatures points away from an active web exploit attempt.
Question 155
Based on an internal assessment, a vulnerability management team wants to proactively identify risks to the infrastructure prior to production deployments. Which of the following best supports this approach?
A. Threat modeling
B. Penetration testing
C. Bug bounty
D. SDLC training
Show Answer
Correct Answer: A
Explanation: Threat modeling is the proactive practice of identifying potential threats, attack paths, and design risks during planning and development, enabling mitigation before production deployment. Penetration testing and bug bounties are typically performed against implemented systems, while SDLC training improves awareness but does not directly identify infrastructure risks prior to deployment.
Question 157
A company was able to reduce triage time by focusing on historical trend analysis. The business partnered with the security team to achieve a 50% reduction in phishing attempts year over year. Which of the following action plans led to this reduced triage time?
A. Patching
B. Configuration management
C. Awareness, education, and training
D. Threat modeling
Show Answer
Correct Answer: C
Explanation: Historical trend analysis can identify phishing patterns and common user behaviors, allowing the organization to target awareness, education, and training where it is most effective. Improving user recognition and reporting of phishing emails reduces successful phishing attempts and the volume of incidents requiring triage, leading to faster triage overall. Patching, configuration management, and threat modeling do not directly explain a year-over-year reduction in phishing attempts through a business-security partnership focused on user behavior.
Question 158
After an upgrade to a new EDR, a security analyst received reports that several endpoints were not communicating with the SaaS provider to receive critical threat signatures. To comply with the incident response playbook, the security analyst was required to validate connectivity to ensure communications. The security analyst ran a command that provided the following:
ComputerName: comptia007 -
RemotePort: 443 -
InterfaceAlias: Ethernet 3 -
TopTestSucceeded: False -
Which of the following did the analyst use to ensure connectivity?
A. nmap
B. tnc
C. ping
D. tracert
Show Answer
Correct Answer: B
Explanation: The output fields shown (ComputerName, RemotePort, InterfaceAlias, and the intended TcpTestSucceeded field, despite the apparent typo 'TopTestSucceeded') match the PowerShell Test-NetConnection cmdlet, commonly invoked via the alias 'tnc'. It is used to verify TCP connectivity to a remote host and port such as HTTPS on port 443.
Question 159
A Chief Information Security Officer (CISO) has decided the cost to protect an asset is greater than the cost of losing the asset. Which of the following risk management principles is the CISO following?
A. Accept
B. Avoid
C. Transfer
D. Mitigate
Show Answer
Correct Answer: A
Explanation: The correct answer is Accept. Risk acceptance is chosen when the cost of implementing controls exceeds the expected loss or impact from the risk, so the organization consciously decides to tolerate the risk rather than spend more to protect the asset.
Question 160
Which of the following best describe the external requirements that are imposed for incident management communication? (Choose two).
A. Law enforcement involvement
B. Compliance with regulatory requirements
C. Transparency to stockholders
D. Defined SLAs regarding services
E. Industry advocacy group participation
F. Framework guidelines
Show Answer
Correct Answer: B, D
Explanation: External requirements for incident management communication commonly include regulatory obligations (such as mandatory breach reporting) and contractual obligations defined in service level agreements (SLAs), which specify communication and notification expectations with customers. Law enforcement involvement is situational rather than a general communication requirement, while framework guidelines and industry groups are generally voluntary, and transparency to stockholders is not a universal incident communication requirement.
Sources:
https://www.hklaw.com/en/insights/publications/2023/07/sec-finalizes-cybersecurity-incident-and-governance-disclosure
Question 161
A systems administrator needs to gather security events with repeatable patterns from Linux log files. Which of the following would the administrator most likely use for this task?
A. A regular expression in Bash
B. Filters in the vi editor
C. Variables in a PowerShell script
D. A playbook in a SOAR tool
Show Answer
Correct Answer: A
Explanation: Regular expressions used with Bash tools such as grep, sed, or awk are the standard way to search Linux log files for repeatable text patterns, making them well suited for identifying recurring security events. vi filters are for interactive editing, PowerShell variables are unrelated to Linux log pattern matching, and SOAR playbooks orchestrate automated response workflows rather than performing basic pattern matching in log files.
Question 162
A security analyst is conducting a vulnerability assessment of a company’s online store. The analyst discovers a critical vulnerability in the payment processing system that could be exploited, allowing attackers to steal customer payment information. Which of the following should the analyst do next?
A. Leave the vulnerability unpatched until the next scheduled maintenance window to avoid potential disruption to business.
B. Perform a risk assessment to evaluate the potential impact of the vulnerability and determine whether additional security measures are needed.
C. Ignore the vulnerability since the company recently passed a payment system compliance audit.
D. Patch the vulnerability as soon as possible to ensure customer payment information is secure.
Show Answer
Correct Answer: B
Explanation: The analyst's role during a vulnerability assessment is to identify and assess vulnerabilities, communicate risk, and recommend remediation. The next step after discovering a critical vulnerability is to perform a risk assessment to evaluate business impact, prioritize remediation, and determine any compensating controls. Implementing patches is typically handled through the organization's change management and operations processes, not unilaterally by the analyst. Delaying until a maintenance window (A) or ignoring the issue due to compliance (C) are inappropriate.
Question 163
Numerous emails were sent to a company’s customer distribution list. The customers reported that the emails contained a suspicious link. The company’s SOC determined the links were malicious. Which of the following is the best way to decrease these emails?
A. DMARC
B. DKIM
C. SPF
D. SMTP
Show Answer
Correct Answer: A
Explanation: DMARC is the best choice because it builds on SPF and DKIM to authenticate email and, importantly, enforces a policy (reject/quarantine) for messages that fail authentication, significantly reducing successful spoofed emails sent using the company's domain. SPF and DKIM alone provide authentication mechanisms but do not specify enforcement. SMTP is simply the mail transfer protocol and does not prevent spoofing.
Question 164
Which of the following choices is most likely to cause obstacles in vulnerability remediation?
A. Not meeting an SLA
B. Patch prioritization
C. Organizational governance
D. Proprietary systems
Show Answer
Correct Answer: D
Explanation: Proprietary systems commonly impede vulnerability remediation because patches may only be available from the vendor, support may be limited, updates may lag, or modifications may be restricted. The other options are related to remediation management or outcomes rather than being inherent obstacles to performing remediation.
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.