Thousands of computers were compromised in a breach, but the vulnerability that caused the compromise was detected on only three computers during the latest vulnerability scan. An analyst conducts an after action review to determine why the vulnerability was not detected on more computers. The analyst recreates the following configuration that was used to scan the network:
Which of the following best explains the reason the vulnerability was found only on three computers?
A. Incorrect remote port specified
B. Lack of concurrent threads dedicated
C. Use of a credentialed vulnerability scan
D. Configuring an incorrect subnet mask
Show Answer
Correct Answer: D
Explanation: The scan configuration used a /24 subnet mask, which limits the scan to 254 usable host addresses. If the environment contained thousands of compromised computers, most systems would never have been included in the scan scope. A single scanning thread would only slow the scan, not reduce the address range. A credentialed scan generally improves detection rather than limiting it to three hosts, and an incorrect remote port would affect specific checks rather than explain why nearly the entire environment was excluded.
Question 232
A corporation wants to implement an agent-based endpoint solution to help:
• Flag various threats
• Review vulnerability feeds
• Aggregate data
• Provide real-time metrics by using scripting languages
Which of the following tools should the corporation implement to reach this goal?
A. DLP
B. Heuristics
C. SOAR
D. NAC
Show Answer
Correct Answer: C
Explanation: SOAR (Security Orchestration, Automation, and Response) is designed to aggregate security data from multiple sources, ingest vulnerability and threat intelligence feeds, automate analysis and response through scripting and playbooks, and provide real-time dashboards and metrics. DLP focuses on preventing data loss, heuristics are a detection technique rather than a comprehensive tool, and NAC controls network access rather than providing orchestration and endpoint security analytics.
Question 233
An analyst receives alerts that state the following traffic was identified on the perimeter network firewall:
Which of the following best describes the indicator of compromise that triggered the alerts?
A. Anomalous activity
B. Bandwidth saturation
C. Cryptomining
D. Denial of service
Show Answer
Correct Answer: D
Explanation: The described indicator is most consistent with a denial-of-service pattern: multiple sources targeting a single destination with repeated small packets over time. There is no evidence of cryptomining, and bandwidth saturation is an effect rather than the primary indicator of compromise. While unusual traffic can be considered anomalous, the specific communication pattern aligns more closely with a DoS/DDoS indicator.
Question 234
A security administrator has found indications of dictionary attacks against the company’s external-facing portal. Which of the following should be implemented to best mitigate the password attacks?
A. Multifactor authentication
B. Password complexity
C. Web application firewall
D. Lockout policy
Show Answer
Correct Answer: D
Explanation: A dictionary attack relies on repeated password guesses against an account. An account lockout policy directly mitigates online dictionary and brute-force attacks by limiting consecutive failed login attempts, making continued guessing impractical. Password complexity reduces the likelihood of a successful guess but does not stop repeated attempts. MFA protects even if a password is guessed, but it does not specifically mitigate the password-guessing attack itself. A WAF is not the primary control for credential guessing.
Question 235
A security analyst needs to identify a computer based on the following requirements to be mitigated:
• The attack method is network based with low complexity.
• No privileges or user action is needed.
• The confidentiality and availability level is high with a low integrity level.
Given the following CVSS 3.1 output:
Computer1 -
CVSS3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
Computer2 -
CVSS3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Computer3 -
CVSS3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
Computer4 -
CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Which of the following machines should the analyst mitigate?
A. Computer1
B. Computer2
C. Computer3
D. Computer4
Show Answer
Correct Answer: D
Explanation: The required CVSS v3.1 metrics are AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), C:H (high confidentiality), I:L (low integrity), and A:H (high availability). Comparing the vectors: Computer1 requires user interaction (UI:R), Computer2 has a local attack vector (AV:L), Computer3 has high attack complexity (AC:H), and Computer4 exactly matches all required metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H.
Question 236
A Chief Information Security Officer has requested a dashboard to share critical vulnerability management goals with company leadership. Which of the following would be the best to include in the dashboard?
A. KPI
B. MOU
C. SLO
D. SLA
Show Answer
Correct Answer: A
Explanation: A dashboard for company leadership should include Key Performance Indicators (KPIs), which are measurable metrics used to track progress toward vulnerability management goals, such as remediation time, patch compliance, and critical vulnerability closure rates. An MOU is a memorandum of understanding, while SLOs and SLAs define service objectives and agreements rather than dashboard metrics.
Question 237
Which of the following is a benefit of the Diamond Model of Intrusion Analysis?
A. It provides analytical pivoting and identifies knowledge gaps.
B. It guarantees that the discovered vulnerability will not be exploited again in the future.
C. It provides concise evidence that can be used in court.
D. It allows for proactive detection and analysis of attack events.
Show Answer
Correct Answer: A
Explanation: The Diamond Model of Intrusion Analysis helps analysts correlate the four core features of an intrusion (adversary, capability, infrastructure, and victim), enabling analytical pivoting between related observations and highlighting intelligence or investigative gaps. It does not guarantee future prevention, is not primarily a legal evidence framework, and while it supports analysis that can aid proactive detection, the distinctive benefit described is analytical pivoting and identification of knowledge gaps.
Question 238
An analyst is imaging a hard drive that was obtained from the system of an employee who is suspected of going rogue. The analyst notes that the initial hash of the evidence drive does not match the resultant hash of the imaged copy. Which of the following best describes the reason for the conflicting investigative findings?
A. Chain of custody was not maintained for the evidence drive.
B. Legal authorization was not obtained prior to seizing the evidence drive.
C. Data integrity of the imaged drive could not be verified.
D. Evidence drive imaging was performed without a write blocker.
Show Answer
Correct Answer: C
Explanation: A mismatch between the original evidence drive hash and the forensic image hash means the image cannot be verified as an exact bit-for-bit copy. The immediate conclusion from the stated facts is that data integrity verification failed. While failing to use a write blocker can cause such a mismatch, the question asks what the conflicting findings best describe, not the underlying cause.
Sources:
https://www.forensicon.com/resources/articles/what-is-forensic-hard-drive-imaging
https://www.sciencedirect.com/topics/computer-science/evidence-hard-drive
Question 239
When investigating a potentially compromised host, an analyst observes that the process BGInfo.exe (PID 1024), a Sysinternals tool used to create desktop backgrounds containing host details, has been running for over two days. Which of the following activities will provide the best insight into this potentially malicious process, based on the anomalous behavior?
A. Changes to system environment variables
B. SMB network traffic related to the system process
C. Recent browser history of the primary user
D. Activities taken by PID 1024
Show Answer
Correct Answer: D
Explanation: A legitimate Sysinternals utility like BGInfo.exe normally runs briefly to generate desktop information and then exits. If it has been running for over two days, the most valuable investigation is to examine the actions performed by that specific process (PID 1024), including its file, registry, process, and network activity, to determine whether it has been hijacked, replaced, or is being abused. The other options provide indirect context but do not directly reveal the anomalous process's behavior.
Question 240
Which of the following attributes is part of the Diamond Model of Intrusion Analysis?
A. Delivery
B. Weaponization
C. Command and control
D. Capability
Show Answer
Correct Answer: D
Explanation: The Diamond Model of Intrusion Analysis is built around four core vertices: Adversary, Capability, Infrastructure, and Victim. Among the options given, only Capability is one of these attributes. The other options (Delivery, Weaponization, and Command and control) are phases from the Cyber Kill Chain, not the Diamond Model.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.