A group of hacktivists has breached and exfiltrated data from several of a bank’s competitors. Given the following network log output:
Which of the following represents the greatest concerns with regard to potential data exfiltration? (Choose two.)
A. 1
B. 2
C. 3
D. 4
E. 5
F. 6
G. 7
Show Answer
Correct Answer: D, G
Explanation: The greatest exfiltration concerns are activity that sends data outside the organization and does so insecurely. Option D indicates a connection to an external IP address, which is a primary indicator of possible data leaving the network. Option G indicates use of an insecure transfer protocol, increasing the likelihood of covert or unauthorized data exfiltration without proper protections.
Question 11
A security analyst is analyzing two vulnerabilities on a critical router. The analyst must choose only one to patch during this maintenance window. Given the following information:
Vulnerability 1 has not received a CVSS score. The vulnerability has the following characteristics:
• Must be logged in to the router, but elevated privileges are not required
• Trivial to exploit, but user interaction is needed
• Low impact to availability, but high impact to confidentiality and integrity
Vulnerability 2 has a CVSS score of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Which of the following conclusions should the analyst reach?
A. Patch Vulnerability 1 because it has a higher overall impact when looking at confidentiality, integrity, and availability, and it requires lower privileges.
B. Patch Vulnerability 1 because it is easier to exploit and has a higher impact on confidentiality.
C. Patch Vulnerability 2 because it has a higher overall impact when looking at confidentiality, integrity, and availability, and it can be exploited by a privileged user.
D. Patch Vulnerability 2 because it is easier to exploit, has a high impact on availability, and it is more likely to be exploited remotely.
Show Answer
Correct Answer: D
Explanation: Vulnerability 2’s CVSS vector indicates network attack vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and high impact to availability (A:H). This makes it remotely exploitable and capable of causing significant disruption to a critical router. Vulnerability 1 requires local login and user interaction, limiting exploitability despite high confidentiality and integrity impact. Given only one patch window, the remotely exploitable issue with high availability impact should be prioritized.
Question 12
Which of the following documents should link to the recovery point objectives and recovery time objectives on critical services?
A. Disaster recovery plan
B. Business impact analysis
C. Playbook
D. Backup plan
Show Answer
Correct Answer: B
Explanation: Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) are determined and documented as part of a Business Impact Analysis (BIA). The BIA analyzes critical services, assesses the impact of outages, and assigns acceptable downtime and data loss targets. The Disaster Recovery Plan and playbooks describe how to meet those targets, not where they are defined or linked to services.
Question 12
An organization’s security operations center (SOC) team prioritizes confidentiality and integrity over monetary considerations. The SOC team contains a quickly progressing ransomware incident. Which of the following factors motivated the SOC team to take this action? (Choose two.)
A. Attack vector
B. Risk appetite
C. Scope
D. Impact
E. Common Vulnerability Scoring System (CVSS) score
F. Asset value
Show Answer
Correct Answer: B, D
Explanation: The SOC prioritized confidentiality and integrity over monetary concerns, which reflects the organization’s risk appetite—its tolerance for different types of risk and what it values most (B). The decision to rapidly contain ransomware is also driven by impact, specifically the potential effect on data confidentiality and integrity if the incident spreads (D). Other options describe technical characteristics or valuation methods that do not explain the motivation behind the response priority.
Question 13
A security analyst reviews a SIEM alert related to a suspicious email and wants to verify the authenticity of the message:
SPF = PASS -
DKIM = FAIL -
DMARC = FAIL -
Which of the following did the analyst most likely discover?
A. An insider threat altered email security records to mask suspicious DNS resolution traffic.
B. The message was sent from an authorized mail server but was not signed.
C. Log normalization corrupted the data as it was brought into the central repository.
D. The email security software did not process all of the records correctly.
Show Answer
Correct Answer: B
Explanation: SPF PASS indicates the sending mail server is authorized for the domain. DKIM FAIL means the message was not properly signed or the signature did not validate. Because DMARC relies on SPF or DKIM alignment, the DKIM failure (and lack of alignment) causes DMARC to fail. This most closely matches a message sent from an authorized server but not signed.
Question 13
An analyst reviews alerts that indicate a number of different users had a spike in login attempts from the same IP. Using the security information and event management (SIEM) system, the analyst finds that a number of users received the following email:
Which of the following best describes this activity?
A. URL shortening
B. Whaling
C. Spoofing
D. Social engineering
Show Answer
Correct Answer: D
Explanation: The activity described is a phishing campaign in which users are deceived into trusting a fraudulent email and interacting with it, leading to credential abuse. Phishing is a form of social engineering, which broadly covers manipulating users into taking unsafe actions. While spoofing may be a technique used (impersonating HR), the best overall description of the activity is social engineering.
Question 14
A systems administrator receives several reports about emails containing phishing links. The hosting domain is always different, but the URL follows a specific pattern of characters.
Which of the following is the best way for the administrator to find more messages that were not reported?
A. Search email logs for a regular expression.
B. Open a support ticket with the email hosting provider.
C. Send a memo to all staff asking them to report suspicious emails.
D. Query firewall logs for any traffic with a suspicious website.
Show Answer
Correct Answer: A
Explanation: The phishing emails share a consistent URL character pattern despite varying domains. Searching email logs with a regular expression allows the administrator to match that pattern and identify additional unreported messages efficiently. The other options do not directly help discover existing emails with the same URL pattern.
Question 14
A critical server hosting final exams for an educational institution fails while students are taking their exams. The final exam deadline is in 16 hours. Which of the following is the best source for guidance on remediation for the IT team?
A. MOU
B. KPI
C. SLA
D. BCP
Show Answer
Correct Answer: D
Explanation: A Business Continuity Plan (BCP) provides documented procedures for responding to major disruptions to critical services and ensuring essential operations continue or are restored within required timeframes. In the event of a critical exam server failure with an imminent deadline, the BCP is the authoritative source guiding remediation and continuity actions. An MOU defines agreements, a KPI measures performance, and an SLA defines service expectations but does not provide incident response guidance.
Question 15
An e-commerce organization recently experienced a cyberattack. During a lessons learned meeting, a cybersecurity analyst requests that the RTO is prioritized. Which of the following is the greatest concern?
A. Integrity
B. Availability
C. Non-repudiation
D. Confidentiality
Show Answer
Correct Answer: B
Explanation: Recovery Time Objective (RTO) defines how quickly systems and services must be restored after a disruption. Prioritizing RTO directly relates to minimizing downtime and ensuring systems are available again within an acceptable timeframe. Therefore, the primary security concern associated with RTO is availability.
Question 15
A security analyst discovers multiple log entries from a recently acquired tool that was bundled as a YUM package. Those entries point to attempts of privilege escalation. Which of the following Is the most likely explanation?
A. The package was modified during installation.
B. The package was missing critical DLL files.
C. The package got corrupted while being downloaded.
D. The package was installed without a GPG check.
Show Answer
Correct Answer: D
Explanation: YUM/RPM packages run with elevated privileges, so a compromised or malicious package can attempt privilege escalation. The primary control that prevents tampered or untrusted packages from being installed is GPG signature verification. Installing the package without a GPG check removes authenticity and integrity validation, making it likely that a modified or malicious package was installed, leading to privilege‑escalation attempts. Corruption or missing files would typically cause install/runtime failures, not systematic privilege‑escalation behavior.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.