A security analyst discovers multiple log entries from a recently acquired tool that was bundled as a YUM package. Those entries point to attempts of privilege escalation. Which of the following Is the most likely explanation?
A. The package was modified during installation.
B. The package was missing critical DLL files.
C. The package got corrupted while being downloaded.
D. The package was installed without a GPG check.
Show Answer
Correct Answer: D
Explanation: A missing GPG check allows installation of an RPM package without verifying its cryptographic signature and origin. That makes it plausible that a tampered or malicious package was installed, leading to privilege-escalation activity. A package being modified during installation is not the typical issue addressed by YUM package security; GPG verification is specifically intended to detect unauthorized package modification before installation. Missing DLLs are irrelevant to Linux YUM packages, and download corruption is more likely to cause installation or integrity errors than targeted privilege-escalation behavior.
Question 25
A security analyst receives an alert with the following packet capture attached:
Which of the following has occurred?
A. sslscan reconnaissance
B. A password stuffing attack
C. An Nmap scan
D. An nc reverse shell
Show Answer
Correct Answer: C
Explanation: The capture shows a TCP connection attempt to SSH port 22: SYN, SYN-ACK, ACK, followed immediately by a reset. That pattern is consistent with an Nmap TCP connect scan, which completes the handshake to identify an open port and then closes the connection. There is no application traffic suggesting password stuffing or a reverse shell, and no TLS exchange characteristic of sslscan.
Question 25
To comply with regulatory requirements, the Chief Executive Officer (CEO) must lead the company through simulations to find which steps are missing m emergency situations or incident processes. Which of the following should the CEO do?
A. Implement the incident response plan.
B. Leverage the appropriate playbook.
C. Develop a business continuity plan.
D. Perform a tabletop exercise.
Show Answer
Correct Answer: D
Explanation: A tabletop exercise is a discussion-based simulation used by executives and incident response stakeholders to walk through emergency scenarios, identify gaps in plans, roles, communications, and procedures, and improve incident response and business continuity processes. It is specifically intended to reveal missing steps before a real incident occurs. Implementing the incident response plan is an operational response, leveraging a playbook is part of executing established procedures, and developing a business continuity plan is a planning activity rather than the simulation itself.
Question 26
A security manager is looking at a third-party vulnerability metric (SMITTEN) to improve upon the company’s current method that relies on CVSSv3. Given the following:
Which of the following vulnerabilities should be prioritized?
A. Vulnerability 1
B. Vulnerability 2
C. Vulnerability 3
D. Vulnerability 4
Show Answer
Correct Answer: B
Explanation: Prioritize Vulnerability 2: it is actively exploited at a high level, is malware-exploitable, and is exposed externally. Although its CVSS score is lower than Vulnerabilities 3 and 4, its current exploitation and exposure make it the most urgent risk.
Question 26
An incident responder is investigating a possible server data exfiltration incident with the intent to prosecute if necessary. The responder:
• Captures live memory and an image of the drives.
• Is given a copy of the firewall logs.
• Pulls the drives from the server.
Which of the following would most likely create an issue?
A. Lack of network capture
B. Chain of custody failure
C. Corrupt drives
D. Encrypted files
Show Answer
Correct Answer: B
Explanation: Because the investigation is intended to support possible prosecution, preserving and documenting the chain of custody is critical. The responder captured memory and disk images, was given only a copy of firewall logs, and then removed the drives, but no evidence is described as being properly documented, transferred, or tracked. A break or lack of documented chain of custody can render otherwise valid evidence vulnerable to legal challenge. The other options may hinder an investigation but are not the primary legal issue implied by the scenario.
Question 27
A security analyst is reviewing a recent vulnerability scan report for a new server infrastructure. The analyst would like to make the best use of time by resolving the most critical vulnerability first. The following information is provided:
Which of the following should the analyst concentrate remediation efforts on first?
A. SVR01
B. SVR02
C. SVR03
D. SVR04
Show Answer
Correct Answer: B
Explanation: SVR02 has an exploitable vulnerability with a CVSS score of 7.1. Although SVR01 has a higher CVSS score and SVR04 has higher asset priority, neither is exploitable. SVR03 is exploitable but has a much lower CVSS score of 3.5, so SVR02 is the best first remediation target.
Question 28
A security analyst discovers that, over three months, an attacker has slowly created multiple accounts on a web server while avoiding detection. Which of the following best describes this threat actor?
A. Script kiddie threat actor
B. Advanced persistent threat actor
C. Insider threat actor
D. Hacktivist threat actor
Show Answer
Correct Answer: B
Explanation: An advanced persistent threat (APT) is characterized by maintaining long-term, stealthy access to a target environment while avoiding detection. An attacker slowly creating multiple accounts over three months to establish persistence fits APT behavior. Script kiddies are typically opportunistic and unsophisticated, insider threats originate from trusted internal users, and hacktivists are generally motivated by ideological goals rather than prolonged covert persistence.
Question 28
A security analyst runs tcpdump on the 10.203.10.22 machine and observes thousands of packets as shown below:
Which of the following activities explains the tcpdump output?
A. Incoming nmap -sA scan
B. hping3 --udp scan over the network
C. C2 communications leaving the network
D. Malware beaconing
Show Answer
Correct Answer: A
Explanation: The packets are TCP ACKs from one source port to many different destination ports on 10.203.10.22. That pattern is characteristic of an incoming Nmap ACK scan (-sA), which probes ports to determine whether they are filtered or unfiltered.
Question 29
An organization wants to implement an identity and access management technology that is resistant to phishing attacks. Which of the following is the best technology to implement?
A. Federation
B. Privileged access management
C. Passwordless authentication
D. Single sign-on
Show Answer
Correct Answer: C
Explanation: Passwordless authentication, particularly phishing-resistant methods such as FIDO2/WebAuthn security keys or platform authenticators, is designed to prevent credential phishing by using public-key cryptography bound to the legitimate origin. Federation and single sign-on improve identity management and user experience but are not inherently phishing-resistant. Privileged access management protects and controls privileged accounts but does not itself provide phishing-resistant authentication.
Question 29
During a training exercise, a security analyst must determine the vulnerabilities to prioritize. The analyst reviews the following vulnerability scan output:
Which of the following issues should the analyst address first?
A. Allows anonymous read access to /etc/passwd
B. Allows anonymous read access via any FTP connection
C. Microsoft Defender security definition updates disabled
D. less command allows for escape exploit via terminal
Show Answer
Correct Answer: A
Explanation: Anonymous remote access to /etc/passwd on the corporate VPN server exposes account information on a critical access system. That directly exploitable exposure takes priority over anonymous FTP on a guest-network PC, a local terminal escape, or disabled Defender definition updates.
Sources:
https://www.sans.org/cyber-security-courses/strategic-vulnerability-threat-management
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
