A company reports that user plain text credentials have been disclosed from their network. A security analyst is identifying the vulnerability and runs a scan to receive the following:
Which of the following computers is the source of the leaked credentials?
A. 10.205.8.14
B. 10.205.8.15
C. 10.205.8.16
D. 10.205.8.17
Show Answer
Correct Answer: D
Explanation: 10.205.8.17 has port 21 open for FTP. Standard FTP sends credentials in plaintext, making this host the likely source of the disclosed credentials.
Question 9
Which of the following are characteristics of Zero Trust Network Access?
A. Application programming interface security and continuous monitoring
B. A gateway controller and agent flows
C. Virtualization and data protection
D. An attack surface and a protect surface
Show Answer
Correct Answer: D
Explanation: Zero Trust Network Access is built around minimizing the attack surface by defining and securing the protect surface, applying least-privilege access and continuous verification. The other options describe related security concepts or components but are not the defining paired characteristics of ZTNA.
Question 10
An organization enabled a SIEM rule to send an alert to a security analyst distribution list when ten failed logins occur within one minute. However, the control was unable to detect an attack with nine failed logins. Which of the following best represents what occurred?
A. False positive
B. True negative
C. False negative
D. True positive
Show Answer
Correct Answer: C
Explanation: A false negative occurs when an actual attack is present but the control fails to detect it. The nine failed logins were part of an attack, but the SIEM rule’s threshold of ten meant no alert was generated.
Question 10
A security analyst investigates a malware alert from a critical system. The following information is present in the ticket:
Which of the following should the analyst do first?
A. Block the suspicious IP address 128.210.175.23.
B. Determine whether sssh is a malicious program.
C. Delete the suspicious files.
D. Review the Apache logs.
Show Answer
Correct Answer: B
Explanation: First determine whether the suspicious process is actually malicious by checking its binary, location, hash, and execution context. Blocking the IP or deleting files before validating the alert could disrupt the system or destroy evidence.
Question 10
Which of the following should a cybersecurity analyst utilize when a notification is inaccurate?
A. Data enrichment
B. Dashboard creation
C. Threat hunting
D. Alert tuning
Show Answer
Correct Answer: D
Explanation: Alert tuning is used to refine detection rules, thresholds, and conditions when notifications are inaccurate or produce false positives/false negatives. Data enrichment adds context after an alert is generated, dashboards visualize information, and threat hunting is a proactive search for threats rather than correcting alert accuracy.
Question 11
Following a recent security incident, the Chief Information Security Officer is concerned with improving visibility and reporting of malicious actors in the environment. The goal is to reduce the time to prevent lateral movement and potential data exfiltration. Which of the following techniques will best achieve the improvement?
A. Mean time to detect
B. Mean time to respond
C. Mean time to remediate
D. Service-level agreement uptime
Show Answer
Correct Answer: A
Explanation: Mean time to detect measures how quickly malicious activity is identified and reported, directly improving visibility. Earlier detection gives responders more opportunity to contain the threat before lateral movement or data exfiltration. Mean time to respond measures the time to act after detection.
Question 11
A security analyst runs the following command:
Which of the following should the analyst recommend first to harden the system?
A. Disable all protocols that do not use encryption.
B. Configure client certificates for domain services.
C. Ensure that this system is behind a NGFW.
D. Deploy a publicly trusted root CA for secure websites.
Show Answer
Correct Answer: A
Explanation: The scan shows Telnet open on port 23. Telnet sends traffic, including credentials, in plaintext, so the first hardening step is to disable it or replace it with an encrypted alternative such as SSH.
Question 12
A vulnerability analyst received a list of system vulnerabilities and needs to evaluate the relevant impact of the exploits on the business. Given the constraints of the current sprint, only three can be remediated. Which of the following represents the least impactful risk, given the CVSS3.1 base scores?
A. AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Base Score 6.0
B. AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Base Score 7.2
C. AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Base Score 6.4
D. AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L - Base Score 6.5
Show Answer
Correct Answer: D
Explanation: D has Low confidentiality, integrity, and availability impacts (C:L/I:L/A:L), so its direct business impact is lowest. A has the lowest overall base score (6.0), but its High confidentiality and integrity impacts make it more damaging if exploited. The base score also reflects exploitability factors, not just impact.
Question 12
A group of hacktivists has breached and exfiltrated data from several of a bank’s competitors. Given the following network log output:
Which of the following represents the greatest concerns with regard to potential data exfiltration? (Choose two.)
A. 1
B. 2
C. 3
D. 4
E. 5
F. 6
G. 7
Show Answer
Correct Answer: D, G
Explanation: Entries 4 and 7 show outbound connections from the bank’s internal network to external destinations. Entry 4 uses HTTPS to an external IP, which could conceal exfiltrated data within encrypted traffic. Entry 7 uses FTP to an external domain; FTP is unencrypted and can be used to transfer data out. The SMB traffic in entry 3 is between internal addresses.
Question 12
Which of the following is the term for a predefined set of automated actions that incident responders and SOC analysts can use to enhance operations?
A. Threat modeling
B. Detection set
C. CVSS
D. Playbooks
Show Answer
Correct Answer: D
Explanation: A playbook is a predefined set of documented and often automated response actions used by SOC analysts and incident responders to standardize and accelerate incident handling. Threat modeling identifies potential threats, a detection set refers to detection rules or logic, and CVSS is a vulnerability severity scoring system.
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
