A security analyst is testing a web application for vulnerabilities using Burp Suite. During the assessment, a capture of the following HTTP request and response is shown in the command-line interface:
After inspecting the request, the security analyst notices that it does not include any additional protections or validation mechanisms. Which of the following vulnerabilities is most likely present in the web application?
A. IDOR
B. CSRF
C. SQLi
D. XSS
Show Answer
Correct Answer: B
Explanation: A state-changing HTTP request that lacks any anti-forgery protection (such as a CSRF token or other request validation mechanism) is most indicative of a Cross-Site Request Forgery vulnerability. IDOR requires evidence of predictable object identifiers with missing authorization checks, SQL injection requires unsanitized database input, and XSS requires unsafe handling of browser-rendered input/output.
Question 22
The architecture team has been given a mandate to reduce the triage time of phishing incidents by 20%. Which of the following solutions will most likely help with this effort?
A. Integrate a SOAR platform.
B. Increase the budget to the security awareness program.
C. Implement an EDR tool.
D. Create new correlation rules for the SIEM.
Show Answer
Correct Answer: A
Explanation: A SOAR (Security Orchestration, Automation, and Response) platform automates repetitive phishing investigation and response tasks, enriching alerts, orchestrating workflows, and reducing analyst triage time. Increasing security awareness helps prevent phishing but does not directly reduce triage time. EDR focuses on endpoint detection rather than email phishing triage. New SIEM correlation rules can improve detection but generally do not streamline the end-to-end phishing triage process as effectively as SOAR.
Question 23
A security analyst is investigating an unusually high volume of requests received on a web server. Based on the following command and output:
Which of the following best describes the activity that the analyst will confirm?
A. SQL injection
B. Directory brute force
C. Remote command execution
D. Cross-site scripting
Show Answer
Correct Answer: B
Explanation: A high volume of requests probing many common directories and file paths on a web server is characteristic of automated directory enumeration (directory brute forcing) using tools that attempt to discover hidden resources. This does not match the request patterns typical of SQL injection, remote command execution, or cross-site scripting.
Question 24
A security analyst discovers multiple log entries from a recently acquired tool that was bundled as a YUM package. Those entries point to attempts of privilege escalation. Which of the following Is the most likely explanation?
A. The package was modified during installation.
B. The package was missing critical DLL files.
C. The package got corrupted while being downloaded.
D. The package was installed without a GPG check.
Show Answer
Correct Answer: D
Explanation: A missing GPG check allows installation of an RPM package without verifying its cryptographic signature and origin. That makes it plausible that a tampered or malicious package was installed, leading to privilege-escalation activity. A package being modified during installation is not the typical issue addressed by YUM package security; GPG verification is specifically intended to detect unauthorized package modification before installation. Missing DLLs are irrelevant to Linux YUM packages, and download corruption is more likely to cause installation or integrity errors than targeted privilege-escalation behavior.
Question 25
To comply with regulatory requirements, the Chief Executive Officer (CEO) must lead the company through simulations to find which steps are missing m emergency situations or incident processes. Which of the following should the CEO do?
A. Implement the incident response plan.
B. Leverage the appropriate playbook.
C. Develop a business continuity plan.
D. Perform a tabletop exercise.
Show Answer
Correct Answer: D
Explanation: A tabletop exercise is a discussion-based simulation used by executives and incident response stakeholders to walk through emergency scenarios, identify gaps in plans, roles, communications, and procedures, and improve incident response and business continuity processes. It is specifically intended to reveal missing steps before a real incident occurs. Implementing the incident response plan is an operational response, leveraging a playbook is part of executing established procedures, and developing a business continuity plan is a planning activity rather than the simulation itself.
Question 26
An incident responder is investigating a possible server data exfiltration incident with the intent to prosecute if necessary. The responder:
• Captures live memory and an image of the drives.
• Is given a copy of the firewall logs.
• Pulls the drives from the server.
Which of the following would most likely create an issue?
A. Lack of network capture
B. Chain of custody failure
C. Corrupt drives
D. Encrypted files
Show Answer
Correct Answer: B
Explanation: Because the investigation is intended to support possible prosecution, preserving and documenting the chain of custody is critical. The responder captured memory and disk images, was given only a copy of firewall logs, and then removed the drives, but no evidence is described as being properly documented, transferred, or tracked. A break or lack of documented chain of custody can render otherwise valid evidence vulnerable to legal challenge. The other options may hinder an investigation but are not the primary legal issue implied by the scenario.
Question 27
A company discovers that its proprietary information is being sold on the dark web. A security analyst uses threat hunting to search for signs of compromise. After running a network packet capture tool, the analyst identifies millions of packets similar to the following:
The analyst does not detect or identify any other abnormalities. Which of the following is most likely the malicious activity in this scenario?
A. An insider is using an IP command-and-control to sell proprietary information.
B. A threat actor is performing exfiltration over an alternative protocol.
C. A machine was infected with a virus that is trying to propagate.
D. A hacktivist is conducting an ICMP DDoS attack against the company.
Show Answer
Correct Answer: B
Explanation: A very large volume of otherwise unremarkable ICMP-like packets is a classic indicator of tunneling or data exfiltration over an alternative protocol. ICMP can be abused to carry data and evade detection. This fits the discovery of proprietary information on the dark web. The other options are less consistent: command-and-control does not by itself explain the packet pattern, virus propagation would show broader infection behavior, and an ICMP DDoS would target availability rather than explain stolen proprietary data.
Question 28
A security analyst discovers that, over three months, an attacker has slowly created multiple accounts on a web server while avoiding detection. Which of the following best describes this threat actor?
A. Script kiddie threat actor
B. Advanced persistent threat actor
C. Insider threat actor
D. Hacktivist threat actor
Show Answer
Correct Answer: B
Explanation: An advanced persistent threat (APT) is characterized by maintaining long-term, stealthy access to a target environment while avoiding detection. An attacker slowly creating multiple accounts over three months to establish persistence fits APT behavior. Script kiddies are typically opportunistic and unsophisticated, insider threats originate from trusted internal users, and hacktivists are generally motivated by ideological goals rather than prolonged covert persistence.
Question 29
An organization wants to implement an identity and access management technology that is resistant to phishing attacks. Which of the following is the best technology to implement?
A. Federation
B. Privileged access management
C. Passwordless authentication
D. Single sign-on
Show Answer
Correct Answer: C
Explanation: Passwordless authentication, particularly phishing-resistant methods such as FIDO2/WebAuthn security keys or platform authenticators, is designed to prevent credential phishing by using public-key cryptography bound to the legitimate origin. Federation and single sign-on improve identity management and user experience but are not inherently phishing-resistant. Privileged access management protects and controls privileged accounts but does not itself provide phishing-resistant authentication.
Question 30
A security analyst is implementing a process to perform vulnerability management on an ОТ environment:
• Systems must remain on an isolated network.
• The process should focus on external threats.
• No additional software can be deployed on the systems.
• Transmitted packets cannot be modified or dropped.
• Additional processing delays are not tolerated.
Which of the following is the best way to securely meet the requirements?
A. Implement agentless sensors at the network edge.
B. Use reverse engineering to detect flaws on the in-scope systems.
C. Deploy an IPS In-line with the network traffic.
D. Check the compatibility of an EDR agent with the OSs used on the ОТ environment.
Show Answer
Correct Answer: A
Explanation: Agentless sensors deployed at the network edge provide passive network monitoring without installing software on OT systems. They do not modify or drop packets, introduce negligible processing delay because they are out-of-band, and can identify external threats while preserving the isolation and stability requirements of the OT environment.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.