A system that provides the user interface for a critical server has potentially been corrupted by malware. Which of the following is the best recommendation to ensure business continuity?
A. System isolation
B. Reimaging
C. Malware removal
D. Vulnerability scanning
Show Answer
Correct Answer: B
Explanation: The goal is to ensure business continuity when a system providing the UI for a critical server may be compromised. Reimaging is the most reliable way to return the system to a known-good, trusted state so operations can safely continue. System isolation is a containment step that can interrupt operations, malware removal is unreliable on a potentially compromised system, and vulnerability scanning does not remediate the issue. Therefore, reimaging best supports continuity.
Question 177
An incident response team is assessing attack vectors of malware that is encrypting data with ransomware. There are no indications of a network-based intrusion. Which of the following is the most likely root cause of the incident?
A. USB drop
B. LFI
C. Cross-site forgery
D. SQL injection
Show Answer
Correct Answer: A
Explanation: With no evidence of a network-based intrusion, the malware most likely entered via a physical vector. A USB drop is a common non-network attack method where a malicious removable drive infects a system when plugged in. The other options (LFI, cross-site forgery, SQL injection) are web/network-based attacks and do not fit the scenario.
Question 178
Which of the following explains the importance of a timeline when providing an incident response report?
A. The timeline contains a real-time record of an incident and provides information that helps to simplify a postmortem analysis.
B. An incident timeline provides the necessary information to understand the actions taken to mitigate the threat or risk.
C. The timeline provides all the information, in the form of a timetable, of the whole incident response process including actions taken.
D. An incident timeline presents the list of commands executed by an attacker when the system was compromised, in the form of a timetable.
Show Answer
Correct Answer: C
Explanation: An incident response timeline is a chronological record of events and actions throughout the entire response process. Its importance lies in showing what happened and when, including actions taken, so stakeholders can understand the full progression of detection, containment, mitigation, and recovery. Other options are either too narrow or incorrectly emphasize real-time recording or attacker-only actions.
Question 179
Executives at an organization email sensitive financial information to external business partners when negotiating valuable contracts. To ensure the legal validity of these messages, the cybersecurity team recommends a digital signature be added to emails sent by the executives. Which of the following are the primary goals of this recommendation? (Choose two.)
A. Confidentiality
B. Integrity
C. Privacy
D. Anonymity
E. Non-reduplication
F. Authorization
Show Answer
Correct Answer: B, E
Explanation: Digital signatures are used to ensure message integrity (the content has not been altered) and non-repudiation, meaning the sender cannot later deny having sent the message. Although the option says "non-reduplication," this is almost certainly a typo for non-repudiation, which is a core legal purpose of digital signatures. They do not provide confidentiality, privacy, anonymity, or authorization.
Question 180
Thousands of computers were compromised in a breach, but the vulnerability that caused the compromise was detected on only three computers during the latest vulnerability scan. An analyst conducts an after action review to determine why the vulnerability was not detected on more computers. The analyst recreates the following configuration that was used to scan the network:
Which of the following best explains the reason the vulnerability was found only on three computers?
A. Incorrect remote port specified
B. Lack of concurrent threads dedicated
C. Use of a credentialed vulnerability scan
D. Configuring an incorrect subnet mask
Show Answer
Correct Answer: D
Explanation: The scan configuration targeted only a /24 subnet, which supports a maximum of 254 usable hosts. Since thousands of computers were actually compromised, most affected systems fell outside the scanned address range. An incorrect subnet mask would therefore cause the vulnerability to be detected on only a small number of systems, regardless of scan speed or threading.
Question 181
A corporation wants to implement an agent-based endpoint solution to help:
• Flag various threats
• Review vulnerability feeds
• Aggregate data
• Provide real-time metrics by using scripting languages
Which of the following tools should the corporation implement to reach this goal?
A. DLP
B. Heuristics
C. SOAR
D. NAC
Show Answer
Correct Answer: C
Explanation: The requirements describe an agent-based solution that can ingest and review threat and vulnerability feeds, aggregate security data, automate analysis, and provide real-time metrics using scripts. These capabilities align with SOAR platforms, which integrate agents, collect and correlate data from multiple sources, automate workflows, and support scripting for real-time monitoring and response. The other options (DLP, heuristics, NAC) address narrower security functions and do not meet all the stated goals.
Question 182
An analyst receives alerts that state the following traffic was identified on the perimeter network firewall:
Which of the following best describes the indicator of compromise that triggered the alerts?
A. Anomalous activity
B. Bandwidth saturation
C. Cryptomining
D. Denial of service
Show Answer
Correct Answer: A
Explanation: The alert is based on observed traffic patterns that deviate from a known baseline (multiple internal sources communicating unusually with a single destination), but there is insufficient evidence to conclusively identify a specific attack type such as denial of service, bandwidth saturation, or cryptomining. Therefore, the indicator of compromise is best described as anomalous activity rather than a confirmed attack.
Question 183
A security administrator has found indications of dictionary attacks against the company’s external-facing portal. Which of the following should be implemented to best mitigate the password attacks?
A. Multifactor authentication
B. Password complexity
C. Web application firewall
D. Lockout policy
Show Answer
Correct Answer: B
Explanation: A dictionary attack relies on trying common or known words as passwords. Enforcing strong password complexity (length, randomness, and avoidance of dictionary words) directly reduces the effectiveness of such attacks. Lockout policies are more commonly associated with mitigating brute-force attacks, while MFA and WAFs provide broader protection but are not the primary control tied specifically to dictionary attacks in this context.
Question 184
A security analyst needs to identify a computer based on the following requirements to be mitigated:
• The attack method is network based with low complexity.
• No privileges or user action is needed.
• The confidentiality and availability level is high with a low integrity level.
Given the following CVSS 3.1 output:
Computer1 -
CVSS3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
Computer2 -
CVSS3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Computer3 -
CVSS3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
Computer4 -
CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Which of the following machines should the analyst mitigate?
A. Computer1
B. Computer2
C. Computer3
D. Computer4
Show Answer
Correct Answer: D
Explanation: The requirements specify a network-based attack (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high confidentiality and availability impact with low integrity impact (C:H/I:L/A:H). Only Computer4’s CVSS vector exactly matches all these criteria. The other options fail at least one requirement (e.g., user interaction required, local attack vector, or high attack complexity).
Question 185
A Chief Information Security Officer has requested a dashboard to share critical vulnerability management goals with company leadership. Which of the following would be the best to include in the dashboard?
A. KPI
B. MOU
C. SLO
D. SLA
Show Answer
Correct Answer: A
Explanation: A dashboard for company leadership should present measurable progress toward vulnerability management goals. Key Performance Indicators (KPIs) provide quantifiable metrics such as mean time to remediate critical vulnerabilities or percentage of critical findings closed. MOUs are agreements, while SLOs and SLAs define targets/commitments rather than report performance. Therefore, KPIs are the best fit.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.