An organization is conducting a pilot deployment of an e-commerce application. The application’s source code is not available. Which of the following strategies should an analyst recommend to evaluate the security of the software?
A. Static testing
B. Vulnerability testing
C. Dynamic testing
D. Penetration testing
Show Answer
Correct Answer: C
Explanation: Because the source code is not available, static testing is not possible. Dynamic testing evaluates the application while it is running (black-box testing) and is well suited for a pilot deployment to identify security issues through observed behavior. Vulnerability testing is typically signature/CVE-based and limited in scope, while penetration testing is more aggressive and usually performed later after baseline testing. Therefore, dynamic testing is the most appropriate strategy.
Question 217
Which of the following entities should an incident manager work with to ensure correct processes are adhered to when communicating incident reporting to the general public, as a best practice? (Choose two.)
A. Law enforcement
B. Governance
C. Legal
D. Manager
E. Public relations
F. Human resources
Show Answer
Correct Answer: C, E
Explanation: Best practice for public incident communication requires coordination with Legal to ensure compliance with laws, regulations, and disclosure obligations, and with Public Relations to manage accurate, consistent, and reputationally appropriate messaging to the general public. Other options do not primarily govern public communications processes.
Question 218
An organization has establish a formal change management process after experiencing several critical system failures over the past year. Which of the following are key factors that the change management process will include in order to reduce the impact of system failures? (Choose two.)
A. Ensure users the document system recovery plan prior to deployment.
B. Perform a full system-level backup following the change.
C. Leverage an audit tool to identify changes that are being made.
D. Identify assets with dependence that could be impacted by the change.
E. Require diagrams to be completed for all critical systems.
F. Ensure that all assets are properly listed in the inventory management system.
Show Answer
Correct Answer: C, D
Explanation: A formal change management process focuses on controlling, assessing, and monitoring changes to reduce failures and their impact. Leveraging an audit tool to identify changes provides visibility, traceability, and accountability for what was modified, which is essential for troubleshooting and preventing unauthorized or risky changes. Identifying assets with dependencies ensures that potential downstream or cascading impacts are understood and mitigated before implementation. The other options are more aligned with disaster recovery, documentation, or asset management, not core change management risk reduction.
Question 219
A cybersecurity analyst has been assigned to the threat-hunting team to create a dynamic detection strategy based on behavioral analysis and attack patterns. Which of the following best describes what the analyst will be creating?
A. Bots
B. IoCs
C. TTPs
D. Signatures
Show Answer
Correct Answer: C
Explanation: A dynamic detection strategy based on behavioral analysis and attack patterns focuses on identifying adversary Tactics, Techniques, and Procedures (TTPs). TTPs describe how attackers operate and enable behavior-based detection beyond static indicators like IoCs or signatures.
Question 220
Which of the following is the most important reason for an incident response team to develop a formal incident declaration?
A. To require that an incident be reported through the proper channels
B. To identify and document staff who have the authority to decrease an incident
C. To allow for public disclosure of a security event impacting the organization
D. To establish the department that responsible for responding to an incident
Show Answer
Correct Answer: A
Explanation: A formal incident declaration exists primarily to ensure that a suspected incident is officially recognized and reported through the proper channels so the incident response process is triggered promptly and consistently. This declaration initiates escalation, coordination, communication, and resource allocation. Other options describe elements of an incident response plan, but they are secondary to the core purpose of formally declaring and reporting an incident.
Question 222
During an incident, a security analyst discovers a large amount of PII has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee’s personal email. Which of the following should the analyst recommend be done first?
A. Place a legal hold on the employee’s mailbox.
B. Enable filtering on the web proxy.
C. Disable the public email access with CASB.
D. Configure a deny rule on the firewall.
Show Answer
Correct Answer: C
Explanation: The first priority in an incident involving PII exfiltration is containment to prevent further data loss. Disabling access to public/personal email through a CASB immediately stops additional unauthorized transfers from corporate systems. Legal hold is important but is typically coordinated with legal/compliance and does not stop ongoing exfiltration. Web proxy filtering or firewall deny rules are broader, less targeted, and may not directly address cloud-based personal email use as effectively as CASB.
Question 223
Which of the following evidence collection methods is most likely to be acceptable in court cases?
A. Copying all access files at the time of the incident
B. Creating a file-level archive of all files
C. Providing a full system backup inventory
D. Providing a bit-level image of the hard drive
Show Answer
Correct Answer: D
Explanation: A bit-level (forensic) image captures an exact sector-by-sector copy of the entire drive, including allocated data, unallocated space, deleted files, and metadata. This preserves evidence integrity, supports verification via hashes, and maintains chain of custody, making it the most acceptable method in court.
Question 224
Which of the following is a reason proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response?
A. To ensure the report is legally acceptable in case it needs to be presented in court
B. To present a lessons-learned analysis for the incident response team
C. To ensure the evidence can be used in a postmortem analysis
D. To prevent the possible loss of a data source for further root cause analysis
Show Answer
Correct Answer: A
Explanation: Proper handling and reporting of evidence preserve its integrity, documentation, and chain of custody. This is essential so that the evidence and resulting report are legally admissible and defensible if the incident leads to legal action or court proceedings.
Question 225
SIMULATION
-
A company recently experienced a security incident. The security team has determined a user clicked on a link embedded in a phishing email that was sent to the entire company. The link resulted in a malware download, which was subsequently installed and run.
INSTRUCTIONS
-
Part 1
-
Review the artifacts associated with the security Incident. Identify the name of the malware, the malicious IP address, and the date and time when the malware executable entered the organization.
Part 2
-
Review the kill chain items and select an appropriate control for each that would improve the security posture of the organization and would have helped to prevent this incident from occurring. Each control may only be used once, and not all controls will be used.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Show Answer
Correct Answer: Part 1:
Malicious executable: invoice.exe
Malicious IP address: 81.161.63.253
Date/time malware entered organization: 1 Dec 2019 14:03:19
Part 2:
Phishing email: Email filtering
Active links: Plain text email format
Malicious website access: IP blocklist
Malware download: Firewall file type filter
Malware install: Restricted local user permissions
Malware execution: Updated antivirus
File encryption: Backups
Explanation: Firewall and email artifacts indicate the phishing email delivered a link that downloaded invoice.exe from a malicious external IP ending in .253, first seen on 1 Dec 2019 at 14:03:19. Mapping controls to the kill chain focuses on stopping the attack as early as possible (email filtering, disabling clickable links), blocking access to known bad IPs, preventing executable downloads, limiting installation via least privilege, detecting execution with antivirus, and mitigating ransomware impact through backups. Each control is used once as required.
Question 226
A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization’s environment. An analyst views the details of these events below:
Which of the following statements best describes the intent of the attacker, based on this one-liner?
A. Attacker is escalating privileges via JavaScript.
B. Attacker is utilizing custom malware to download an additional script.
C. Attacker is executing PowerShell script “AccessToken.ps1”.
D. Attacker is attempting to install persistence mechanisms on the target machine.
Show Answer
Correct Answer: C
Explanation: The one-liner uses legitimate Windows components (rundll32/MSHTML → JavaScript → PowerShell) to execute a PowerShell command that downloads and immediately executes `AccessToken.ps1` via `IEX (New-Object Net.WebClient).DownloadString(...)`. The clearest intent shown is executing that specific PowerShell script, not privilege escalation or persistence, and it does not require custom malware.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
