A security analyst has identified outgoing network traffic leaving the enterprise at odd times. The traffic appears to pivot across network segments and target domain servers. The traffic is then routed to a geographic location to which the company has no association. Which of the following best describes this type of threat?
A. Hacktivist
B. Zombie
C. Insider threat
D. Nation-state actor
Show Answer
Correct Answer: D
Explanation: The described activity—stealthy outbound traffic at unusual times, lateral movement across network segments, targeting domain controllers/servers, and exfiltration to a foreign geographic location—is most consistent with an advanced persistent threat typically associated with a nation-state actor. A zombie is a compromised host, not a threat actor classification, while hacktivists usually seek disruption or publicity and an insider threat originates from an authorized individual within the organization.
Question 185
An XSS vulnerability was reported on one of the public websites of a company. The security department confirmed the finding and needs to provide a recommendation to the application owner. Which of the following recommendations will best prevent this vulnerability from being exploited? (Choose two.)
A. Implement an IPS in front of the web server.
B. Enable MFA on the website.
C. Take the website offline until it is patched.
D. Implement a compensating control in the source code.
E. Configure TLS v1.3 on the website.
F. Fix the vulnerability using a virtual patch at the WA
Show Answer
Correct Answer: D, F
Explanation: The best recommendations are to remediate the application by implementing compensating controls in the source code (such as proper output encoding, input validation, or sanitization) and to deploy a virtual patch at the web application firewall (WAF) to block known XSS exploit attempts until the application is fully fixed. An IPS is not application-aware enough to reliably prevent XSS, MFA and TLS do not address XSS, and taking the site offline is a drastic operational measure rather than the best security recommendation.
Question 186
An analyst is investigating a phishing incident and has retrieved the following as part of the investigation:
cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -
EncodedCommand
A. Echo the command payload content into ‘base64 -d‘.
B. Execute the command from a Windows VM.
C. Use a command console with administrator privileges to execute the code.
D. Run the command as an unprivileged user from the analyst workstation.
Show Answer
Correct Answer: A
Explanation: The PowerShell command uses the -EncodedCommand parameter, which indicates the payload is Base64-encoded (typically UTF-16LE in PowerShell). The safest first step is to decode the payload to inspect the script statically rather than executing potentially malicious code. Running the command, even in a VM, is a later dynamic-analysis step, while executing it on a workstation or with elevated privileges is inappropriate.
Question 187
An employee received a phishing email that contained malware targeting the company. Which of the following is the best way for a security analyst to get more details about the malware and avoid disclosing information?
A. Upload the malware to the VirusTotal website.
B. Share the malware with the EDR provider.
C. Hire an external consultant to perform the analysis.
D. Use a local sandbox in a microsegmented environment.
Show Answer
Correct Answer: D
Explanation: A local sandbox in a microsegmented environment allows the analyst to safely execute and observe the malware's behavior while keeping the sample and any potentially sensitive company information inside the organization's controlled environment. Uploading to a public service like VirusTotal or sharing externally may disclose indicators or proprietary information, and hiring a consultant is not the best immediate technical method for safe malware analysis.
Question 188
Several critical bugs were identified during a vulnerability scan. The SLA risk requirement is that all critical vulnerabilities should be patched within 24 hours. After sending a notification to the asset owners, the patch cannot be deployed due to planned, routine system upgrades. Which of the following is the best method to remediate the bugs?
A. Reschedule the upgrade and deploy the patch.
B. Request an exception to exclude the patch from installation.
C. Update the risk register and request a change to the SLA.
D. Notify the incident response team and rerun the vulnerability scan.
Show Answer
Correct Answer: A
Explanation: The organization has a defined requirement that all critical vulnerabilities must be patched within 24 hours. Planned routine upgrades do not outweigh a critical security SLA. The appropriate remediation is to prioritize deployment of the security patch by rescheduling the routine upgrade if necessary. Requesting an exception or changing the SLA weakens the control rather than remediating the risk, and notifying the incident response team or simply rescanning does not fix the vulnerability.
Question 189
Which of the following will most likely cause severe issues with authentication and logging?
A. Virtualization
B. Multifactor authentication
C. Federation
D. Time synchronization
Show Answer
Correct Answer: D
Explanation: Time synchronization is critical for both authentication and logging. Authentication mechanisms such as Kerberos rely on closely synchronized clocks to validate tickets and prevent replay attacks. Unsynchronized time can cause authentication failures. Logging also depends on accurate timestamps across systems to correlate events and reconstruct incident timelines; clock drift makes logs unreliable.
Question 190
A manufacturing company’s assembly line machinery only functions on an end-of-life OS. Consequently, no patches exist for several highly exploitable OS vulnerabilities. Which of the following is the best mitigating control to reduce the risk of these current conditions?
A. Enforce strict network segmentation to isolate vulnerable systems from the production network.
B. Increase the system resources for vulnerable devices to prevent denial of service.
C. Perform penetration testing to verify the exploitability of these vulnerabilities.
D. Develop in-house patches to address these vulnerabilities.
Show Answer
Correct Answer: A
Explanation: When legacy systems must remain on an end-of-life operating system and cannot be patched, the most effective compensating control is to isolate them through strict network segmentation. This reduces the attack surface and limits lateral movement if the system is compromised. Increasing system resources does not address security vulnerabilities, penetration testing only assesses risk without mitigating it, and developing in-house OS patches is generally impractical and unreliable for an unsupported operating system.
Question 191
An incident responder was able to recover a binary file through the network traffic. The binary file was also found in some machines with anomalous behavior. Which of the following processes most likely can be performed to understand the purpose of the binary file?
A. File debugging
B. Traffic analysis
C. Reverse engineering
D. Machine isolation
Show Answer
Correct Answer: C
Explanation: Reverse engineering is the appropriate process for determining the purpose and behavior of a recovered binary. It includes static and dynamic analysis, disassembly, and decompilation to understand functionality or malicious capabilities. Traffic analysis examines network communications rather than the binary itself, machine isolation is a containment action, and debugging is primarily for diagnosing software execution issues rather than analyzing an unknown binary's purpose.
Question 192
A SOC analyst wants to improve the proactive detection of malicious emails before they are delivered to the destination inbox. Which of the following is the best approach the SOC analyst can recommend?
A. Install UEBA software on the network.
B. Validate and quarantine emails with invalid DKIM and SPF headers.
C. Implement an EDR system on each endpoint.
D. Deploy a DLP platform to block unauthorized and suspicious content.
Show Answer
Correct Answer: B
Explanation: Validating sender authentication using SPF and DKIM and quarantining messages that fail these checks helps detect and stop spoofed or malicious emails before they reach users' inboxes. UEBA and EDR focus on user/endpoint behavior after delivery, while DLP is intended to prevent unauthorized data exfiltration rather than identify inbound malicious email.
Question 193
Which of the following documents sets requirements and metrics for a third-party response during an event?
A. BIA
B. DRP
C. SLA
D. MOU
Show Answer
Correct Answer: C
Explanation: A Service Level Agreement (SLA) defines the expected service performance, response times, availability, and measurable metrics that a third-party provider must meet, including during incident or event response. A BIA identifies business impacts, a DRP outlines disaster recovery procedures, and an MOU expresses a general understanding between parties but typically does not establish enforceable service metrics.
$19
Get all 542 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.