A SOC team lead occasionally collects some DNS information for investigations. The team lead assigns this task to a new junior analyst. Which of the following is the best way to relay the process information to the junior analyst?
A. Ask another team member to demonstrate their process.
B. Email a link to a website that shows someone demonstrating a similar process.
C. Let the junior analyst research and develop a process.
D. Write a step-by-step document on the team wiki outlining the process.
Show Answer
Correct Answer: D
Explanation: A documented, step-by-step process on the team wiki provides a standardized, repeatable, and maintainable reference that all team members can follow. It supports consistency, onboarding, and future updates better than ad hoc demonstrations, external links, or asking the analyst to develop their own process.
Question 72
Which of the following does a security policy do?
A. Establishes a cost model for security activity
B. Identifies and clarifies security goals and objectives
C. Enables management to define system access rules
D. Allows management to define system recovery requirements
Show Answer
Correct Answer: B
Explanation: A security policy is a high-level management statement that defines an organization's security goals, objectives, and direction. It provides the framework for standards, procedures, and controls. It does not establish cost models, define detailed system access rules, or specify system recovery requirements, which are addressed by more specific policies or plans.
Question 73
A report contains IoC and TTP information for a zero-day exploit that leverages vulnerabilities in a specific version of a web application. Which of the following actions should a SOC analyst take first after receiving the report?
A. Implement a vulnerability scan to determine whether the environment is at risk.
B. Block the IP addresses and domains from the report in the web proxy and firewalls.
C. Verify whether the information is relevant to the organization.
D. Analyze the web application logs to identify any suspicious or malicious activity.
Show Answer
Correct Answer: C
Explanation: The first action after receiving threat intelligence is to determine whether it is applicable to the organization's environment. If the organization does not use the affected web application or vulnerable version, subsequent actions such as scanning, blocking IoCs, or log analysis may be unnecessary. Once relevance is confirmed, the analyst can assess exposure, hunt for indicators, and implement mitigations as appropriate.
Question 74
The Chief Information Security Officer wants the same level of security to be present whether a remote worker logs in at home or at a coffee shop. Which of the following should be recommended as a starting point?
A. Non-persistent virtual desktop infrastructures
B. Passwordless authentication
C. Standard-issue laptops
D. Serverless workloads
Show Answer
Correct Answer: A
Explanation: Non-persistent VDI provides a centrally managed desktop environment with consistent security controls regardless of the user's physical location or local network. Because sessions are reset after logout and data remains centralized, it helps ensure the same security posture whether connecting from home or a public Wi-Fi network. Passwordless authentication strengthens authentication only, standard-issue laptops improve device consistency but not location-independent security, and serverless workloads are unrelated to remote endpoint access.
Question 75
The most recent vulnerability scan results show the following:
The vulnerability team learned the following from the asset owners:
• Server HQFIN01 is a financial transaction database server used in the company's largest business unit.
• Server HQADMIN02 is utilized by an end user with administrator privileges to several critical applications.
• No compensating controls exist for either issue.
Which of the following would the vulnerability team most likely do to determine remediation prioritization?
A. Review the BCP and prioritize the remediation of the asset that would take more time to bring online for operational use.
B. Contact the network and desktop engineering teams to discuss prioritizing the asset that is faster to remediate.
C. Reference the BIA to determine the value designation and prioritize vulnerability remediation of the more critical asset.
D. Identify the network placement and configuration of each asset, then prioritize the asset with the least recent backups.
Show Answer
Correct Answer: C
Explanation: A Business Impact Analysis (BIA) is used to determine the business criticality and value of assets. When prioritizing vulnerability remediation, especially when there are no compensating controls, organizations should consider business impact in addition to technical severity. A BCP focuses on recovery, remediation speed is not the primary risk-based criterion, and backup recency or network placement do not determine business-critical remediation priority in this scenario.
Question 76
A finance department employee opens an unsolicited email that contains a malicious payload. The payload quickly spreads through the finance department, but does not affect other departments. Which of the following best explains why the payload does not affect all departments?
A. OS version
B. Offline computers
C. Firewall configuration
D. Network segmentation
Show Answer
Correct Answer: D
Explanation: The malware spreads within the finance department but not to other departments, indicating that the network is segmented into separate security or broadcast domains (such as VLANs or subnets) that restrict lateral movement. OS version, offline computers, or firewall configuration do not as directly explain why the spread is contained specifically along departmental boundaries.
Question 77
Which of the following explains why a company would consider enriching data before sending it to the SIEM?
A. To prevent injection attacks against the log management system
B. To reduce the amount and cost of data storage for security incidents
C. To provide more information to SOC analysts when analyzing events
D. To normalize the data before saving it to the database tables
Show Answer
Correct Answer: C
Explanation: Data enrichment adds contextual information (such as asset details, user identity, threat intelligence, or geolocation) to raw events before they reach the SIEM. This gives SOC analysts more context for investigation and correlation. It is not primarily intended to prevent injection attacks, reduce storage costs, or normalize data (normalization is a separate processing step).
Question 78
A security analyst is performing a malware analysis on a device and receives the following instructions:
• Reduce the blast radius of the potential threat.
• Preserve forensic data for post-incident analysis.
• If securely possible, preserve connectivity for live analysis.
Which of the following will best help the analyst during the investigation?
A. Configure an EDR agent to isolate the network with authorized exceptions to the NOC VLAN.
B. Execute a SOAR playbook to trigger a malware scan on the company's assets.
C. Use file integrity monitoring to determine if the suspicious file was modified.
D. Collect the suspicious file using SFTP and reimage the device.
Show Answer
Correct Answer: A
Explanation: The best choice is to use an EDR agent to isolate the affected endpoint while allowing authorized exceptions for security operations. This reduces the malware's ability to spread, preserves the system in its current state for forensic analysis, and maintains limited connectivity for live investigation if needed. The other options either do not contain the threat, are not focused on the affected device, or destroy valuable forensic evidence by reimaging.
Question 79
A security analyst is responding to an incident that is related to an unauthorized communication between systems. While triaging the event, the analyst obtains the following outputs:
Which of the following commands should the analyst use to terminate the malicious session?
A. kill -9 4347
B. kill -9 6015
C. kill -9 701
D. kill -9 5996
Show Answer
Correct Answer: D
Explanation: The malicious session is established by the Python process (PID 5996), which is creating the unauthorized socket connection. Sending SIGKILL to that process terminates the communication. The other listed PIDs correspond to legitimate or unrelated processes and would not stop the malicious session.
Question 80
A company suspects a coordinated effort to attack their platform. Web server logs show malicious activity from many different source IP addresses located in different countries. Which of the following will best help a security analyst identify the requests connected to this campaign?
A. Modify the web server logs to include the X-Forwarded-For header.
B. Create a custom SIEM query to integrate threat intel IoCs associated with the threat actor.
C. Enrich the web server request logs with full WHOIS data on all available sources.
D. Add GeoIP location for the source IP addresses to the log entries.
Show Answer
Correct Answer: B
Explanation: A coordinated campaign using many IP addresses is best identified by correlating web requests with known threat intelligence indicators of compromise (IoCs) associated with a threat actor. X-Forwarded-For helps recover original client IPs when proxies/load balancers are involved, but it does not identify which requests belong to a specific campaign. WHOIS and GeoIP provide context but are not effective for campaign attribution.
Sources:
https://www.recordedfuture.com/case-study/tbi-bank
https://www.misp-project.org
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.