A security analyst receives the following information about the company's systems. They need to prioritize which systems should be given the resources to improve security.
Which of the following systems should the analyst remediate first?
A. Computer1
B. Server1
C. Computer2
D. Server2
Show Answer
Correct Answer: B
Explanation: Server1 should be prioritized because it is running an end-of-life operating system that no longer receives security updates, leaving known vulnerabilities permanently unpatched. Unsupported systems generally present the highest remediation priority compared with systems that still receive vendor security updates.
Question 32
The security team is reviewing a list of vulnerabilities present on the environment, and they want to prioritize the remediation based on the CVSS v4.0 metrics:
Which of the following vulnerabilities should the security manager request to fix first?
A. System A
B. System B
C. System C
D. System D
E. System E
Show Answer
Correct Answer: A
Explanation: The question references CVSS v4.0 metrics, but the metric values for Systems A–E are not included. Based on CVSS v4.0 prioritization, a vulnerability with Active Exploitation (E:A) is prioritized over one with only Proof-of-Concept exploit maturity, even if other base metrics are similar. Therefore, the best supported choice is System A. The provided web search results are unrelated.
Question 33
An application security analyst needs to test a web application for input validation vulnerabilities. The analyst does not have the source code and does not have documentation for the APIs. Which of the following techniques will best aid the analyst in vulnerability testing?
A. Fuzzing operation
B. Agentless scanning
C. Reverse engineering
D. Use of a SAST tool
Show Answer
Correct Answer: A
Explanation: Fuzzing is the best technique for testing input validation vulnerabilities when source code and API documentation are unavailable. It exercises the application with unexpected, malformed, or random inputs to identify validation flaws, crashes, and other anomalous behavior. SAST requires source code, agentless scanning is not focused on input validation testing, and reverse engineering is less effective than directly fuzzing inputs for this objective.
Question 34
The website of a large retail chain is falling to enforce encrypted HTTPS connections, leaving customer account credentials exposed. Which of the following is the best corrective action for resolving this issue?
A. Remove any redirect settings of HTTP connections to HTTPS.
B. Implement HTTP Strict Transport Security Headers.
C. Install a self-signed certificate on the web server.
D. Reduce the default timeout period for all web-based sessions.
Show Answer
Correct Answer: B
Explanation: HTTP Strict Transport Security (HSTS) instructs browsers to always use HTTPS for the site after the initial secure connection, preventing downgrade and SSL stripping attacks and enforcing encrypted connections. Removing HTTP-to-HTTPS redirects would worsen security, a self-signed certificate does not provide trusted transport security, and session timeout settings do not address unencrypted credential transmission.
Question 35
During a routine review of DNS logs, a security analyst observes that Host X has been making frequent DNS requests to domains with random alphanumeric strings (e.g.. atd8ekthj.xyz). IPS anomaly rules are blocking these domains. This behavior started shortly after a new software Installation on the host. Which of the following should the analyst do first to determine whether Host X has been compromised?
A. Allow the domains because the DNS requests are part of a misconfigured software update.
B. Check the software installation logs for errors and reinstall the software.
C. Block all outbound connections from the host to prevent further DNS queries.
D. Use threat intelligence to check if the queried domains are associated with legitimate sites.
Show Answer
Correct Answer: D
Explanation: Frequent DNS requests to random-looking domains shortly after software installation can indicate a Domain Generation Algorithm (DGA), but they may also be legitimate. The first step in determining whether the host is compromised is to validate the domains using threat intelligence to see whether they are known malicious or associated with legitimate services. Immediately allowing the traffic (A) is unsafe, reinstalling software (B) does not determine compromise, and isolating the host (C) is a containment action that typically follows confirmation or a higher-confidence assessment rather than being the first investigative step.
Question 36
A security analyst is working on a suspicious email forwarded from a user. The email contains an attachment asking the user to open it. Which of the following should the security analyst review to best determine email authentication and its attack origin?
A. DMARC
B. SMTP
C. Joe Sandbox
D. URL rewriting
Show Answer
Correct Answer: A
Explanation: DMARC is the email authentication policy framework that builds on SPF and DKIM. Reviewing DMARC results (along with related authentication headers) helps determine whether the sender domain authenticated successfully and whether the message may be spoofed, aiding attribution of the attack origin. SMTP is the mail transport protocol, Joe Sandbox analyzes attachments rather than email authentication, and URL rewriting protects/analyzes links rather than verifying sender authenticity.
Question 37
When undertaking a cloud migration of multiple SaaS applications, an organization's systems administrators struggled with the complexity of extending identity and access management to cloud-based assets. Which of the following service models would have reduced the complexity of this project?
A. RADIUS
B. SDN
C. ZTNA
D. SWG
Show Answer
Correct Answer: C
Explanation: ZTNA (Zero Trust Network Access) is designed to provide identity-centric access to applications, especially SaaS and cloud resources. It integrates with modern IAM, SSO, and MFA, reducing the complexity of extending identity and access management to cloud-hosted assets. RADIUS is an authentication protocol, SDN is a networking architecture, and SWG focuses on web traffic security rather than simplifying cloud IAM.
Question 38
An organization's Chief Information Security Officer (CISO) is organizing a tabletop drill. The CISO has included several other executives in the meeting invitation for the drill, as required. Which of the following is the best reason for including the Chief Communications Officer?
A. Deciding when and how to issue press releases regarding incidents can minimize damage to the organization's brand reputation.
B. All of the organization's high-level executives should know about the IT department's incident response plan.
C. All parties must be able to communicate clearly. concisely, and consistently during incident response.
D. The CISO would like to increase the security department's visibility to senior executives.
Show Answer
Correct Answer: A
Explanation: The Chief Communications Officer is responsible for managing external communications, media relations, and protecting the organization's public image. During a cybersecurity incident, decisions about when and how to communicate with customers, regulators, and the press are critical to minimizing reputational damage while coordinating with legal and incident response. The other options are either too general or not specific to the CCO's role.
Question 39
An analyst reviews the following web server log entries:
%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd
No attacks or malicious attempts have been discovered. Which of the following most likely describes what took place?
A. A SQL injection query took place to gather information from a sensitive file.
B. A PHP injection was leveraged to ensure that the sensitive file could be accessed.
C. Base64 was used to prevent the IPS from detecting the fully encoded string.
D. Directory traversal was performed to obtain a sensitive file for further reconnaissance.
Show Answer
Correct Answer: D
Explanation: The path '%2E%2E/' is URL-encoded '../', which is used in directory traversal attacks to move up the directory tree. Repeating it before '/etc/passwd' is a classic attempt to access the sensitive Unix password file for reconnaissance. This is not SQL injection, PHP injection, or Base64 encoding.
Question 40
A company reports that user plain text credentials have been disclosed from their network. A security analyst is identifying the vulnerability and runs a scan to receive the following:
Which of the following computers is the source of the leaked credentials?
A. 10.205.8.14
B. 10.205.8.15
C. 10.205.8.16
D. 10.205.8.17
Show Answer
Correct Answer: D
Explanation: The host most likely responsible is 10.205.8.17 because it has FTP (TCP port 21) exposed. Standard FTP transmits usernames and passwords in plaintext unless replaced by a secure alternative such as FTPS or SFTP, making it a common source of leaked plaintext credentials.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.