An end user forwarded an email with a file attachment to the SOC for review. The SOC analysts think the file was specially crafted for the target. Which of the following investigative actions would best determine if the attachment was malicious?
A. Review the file in Virus Total to determine if the domain is associated with any phishing.
B. Review the email header to analyze the DKIM, DMARC, and SPF values.
C. Review the source IP address in AbuseIPDB.
D. Review the attachment’s behavior in a sandbox environment while running Wireshark.
Show Answer
Correct Answer: D
Explanation: The best way to determine whether a specially crafted attachment is malicious is to execute it safely in an isolated sandbox and observe its behavior, including network activity with Wireshark. Behavioral analysis can reveal malicious actions that static reputation checks may miss, especially for targeted or novel malware. VirusTotal, email authentication checks (DKIM/SPF/DMARC), and source IP reputation provide useful context about the email or sender but do not directly determine whether the attachment itself is malicious.
Question 222
A security analyst reviews the following results of a Nikto scan:
Which of the following should the security administrator investigate next?
A. tiki
B. phpList
C. shtml.exe
D. sshome
Show Answer
Correct Answer: B
Explanation: The highest-priority finding to investigate is phpList because outdated or vulnerable phpList installations have historically included serious issues such as unauthorized administrative access and information disclosure, representing a substantially greater risk than informational findings or less impactful legacy CGI issues. A vulnerable web application with potential administrative compromise warrants immediate follow-up.
Question 223
An organization plans to use an advanced machine-learning tool as a central collection server. The tool will perform data aggregation and analysis. Which of the following should the organization implement?
A. SIEM
B. Firewalls
C. Syslog server
D. Flow analysis
Show Answer
Correct Answer: A
Explanation: A Security Information and Event Management (SIEM) system serves as a central collection point for logs and security events, performs data aggregation and correlation, and modern SIEM platforms commonly incorporate advanced analytics and machine learning for threat detection and analysis. A firewall filters network traffic, a syslog server primarily collects logs without advanced analytics, and flow analysis focuses on network traffic patterns rather than acting as the central aggregation and ML analysis platform.
Question 224
A company’s internet-facing web application has been compromised several times due to identified design flaws. The company would like to minimize the risk of these incidents from reoccurring and has provided the developers with better security training. However, the company cannot allocate any more internal resources to the issue. Which of the following are the best options to help identify flaws within the system? (Choose two.)
A. Deploying a WAF
B. Performing a forensic analysis
C. Contracting a penetration test
D. Holding a tabletop exercise
E. Creating a bug bounty program
F. Implementing threat modeling
Show Answer
Correct Answer: C, E
Explanation: An external penetration test is a direct way to identify exploitable flaws in the application without requiring additional internal security resources. A bug bounty program continuously incentivizes external researchers to discover and report vulnerabilities, helping identify design and implementation flaws. A WAF mitigates attacks rather than finding root flaws, forensic analysis investigates past incidents, tabletop exercises test response, and threat modeling is valuable but requires internal effort, which the scenario says cannot be allocated.
Question 225
A web application has a function to retrieve content from an internal URL to identify CSRF attacks in the logs. The security analyst is building a regular expression that will filter out the correctly formatted requests. The target URL is https://10.1.2.3/api, and the receiving API only accepts GET requests and uses a single integer argument named “id.” Which of the following regular expressions should the analyst use to achieve the objective?
A. ^(?!https://10\.1\.2\.3/api\?id=[0-9]+)
B. ^https://10\.1\.2\.3/api\?id=\d+
C. (?:^https://10\.1\.2\.3/api\?id=[0-9]+)
D. ^https://10\.1\.2\.3/api\?id=[0-9]+$
Show Answer
Correct Answer: D
Explanation: The regex should match the entire URL exactly: ^ anchors the start, https://10\.1\.2\.3/api\?id= matches the literal URL and query parameter name, [0-9]+ matches one or more digits for the integer id, and $ anchors the end so no extra characters are allowed. Option B lacks an end anchor, C lacks an end anchor and uses a non-capturing group unnecessarily, and A is a negative lookahead rather than a positive match.
Question 226
Which of the following is instituting a security policy that users must lock their systems when stepping away from their desks an example of?
A. Configuration management
B. Compensating control
C. Awareness, education, and training
D. Administrative control
Show Answer
Correct Answer: D
Explanation: Instituting a policy that requires users to lock their workstations is an administrative control because it is a management-directed policy governing user behavior. Awareness, education, and training help users understand and follow the policy, but the policy itself is the administrative control. It is not configuration management or a compensating control.
Question 227
A system that provides the user interface for a critical server has potentially been corrupted by malware. Which of the following is the best recommendation to ensure business continuity?
A. System isolation
B. Reimaging
C. Malware removal
D. Vulnerability scanning
Show Answer
Correct Answer: B
Explanation: Reimaging is the best recommendation because a system that has potentially been corrupted by malware cannot be trusted. Reimaging restores it to a known-good state, which is the standard remediation for a compromised critical system. System isolation is an important immediate containment step, but it does not by itself ensure business continuity or restore trusted operation. Malware removal is less reliable than rebuilding from a known-good image, and vulnerability scanning does not remediate a compromise.
Question 228
An incident response team is assessing attack vectors of malware that is encrypting data with ransomware. There are no indications of a network-based intrusion. Which of the following is the most likely root cause of the incident?
A. USB drop
B. LFI
C. Cross-site forgery
D. SQL injection
Show Answer
Correct Answer: A
Explanation: A USB drop is the most likely root cause because it is a non-network attack vector that can introduce ransomware when a user plugs in a malicious USB device. The other options (LFI, cross-site request forgery, and SQL injection) are web/network-based attack techniques, which are inconsistent with the scenario stating there are no indications of a network-based intrusion.
Question 229
Which of the following explains the importance of a timeline when providing an incident response report?
A. The timeline contains a real-time record of an incident and provides information that helps to simplify a postmortem analysis.
B. An incident timeline provides the necessary information to understand the actions taken to mitigate the threat or risk.
C. The timeline provides all the information, in the form of a timetable, of the whole incident response process including actions taken.
D. An incident timeline presents the list of commands executed by an attacker when the system was compromised, in the form of a timetable.
Show Answer
Correct Answer: C
Explanation: An incident response timeline is a chronological record of the incident and the response activities, documenting key events and actions taken throughout the lifecycle of the incident. Its value in a report is that it provides a complete, time-ordered view of what happened and what responders did. Option A is inaccurate because a timeline is not inherently a 'real-time record' and overemphasizes postmortem analysis. Option B is too narrow because it focuses only on mitigation actions. Option D incorrectly limits the timeline to attacker commands.
Question 230
Executives at an organization email sensitive financial information to external business partners when negotiating valuable contracts. To ensure the legal validity of these messages, the cybersecurity team recommends a digital signature be added to emails sent by the executives. Which of the following are the primary goals of this recommendation? (Choose two.)
A. Confidentiality
B. Integrity
C. Privacy
D. Anonymity
E. Non-reduplication
F. Authorization
Show Answer
Correct Answer: B, E
Explanation: Digital signatures provide integrity by allowing recipients to detect any modification to the signed message. They also provide non-repudiation, which supports the legal validity of messages by allowing the sender's identity and signature to be verified. The option 'Non-reduplication' is not a standard security property and is almost certainly a typo for 'non-repudiation'; under that interpretation, E is the intended answer. Digital signatures do not provide confidentiality, privacy, anonymity, or authorization by themselves.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.