A security analyst reviews the following results of a Nikto scan:
Which of the following should the security administrator investigate next?
A. tiki
B. phpList
C. shtml.exe
D. sshome
Show Answer
Correct Answer: B
Explanation: Investigate phpList first. The scan identifies a vulnerable pre-2.6.4 version with potential remote administrative access and exposes default admin credentials, creating a serious risk of unauthorized control and user-data access.
Question 36
A security analyst is working on a suspicious email forwarded from a user. The email contains an attachment asking the user to open it. Which of the following should the security analyst review to best determine email authentication and its attack origin?
A. DMARC
B. SMTP
C. Joe Sandbox
D. URL rewriting
Show Answer
Correct Answer: A
Explanation: DMARC is the email authentication policy framework that builds on SPF and DKIM. Reviewing DMARC results (along with related authentication headers) helps determine whether the sender domain authenticated successfully and whether the message may be spoofed, aiding attribution of the attack origin. SMTP is the mail transport protocol, Joe Sandbox analyzes attachments rather than email authentication, and URL rewriting protects/analyzes links rather than verifying sender authenticity.
Question 37
When undertaking a cloud migration of multiple SaaS applications, an organization's systems administrators struggled with the complexity of extending identity and access management to cloud-based assets. Which of the following service models would have reduced the complexity of this project?
A. RADIUS
B. SDN
C. ZTNA
D. SWG
Show Answer
Correct Answer: C
Explanation: ZTNA (Zero Trust Network Access) is designed to provide identity-centric access to applications, especially SaaS and cloud resources. It integrates with modern IAM, SSO, and MFA, reducing the complexity of extending identity and access management to cloud-hosted assets. RADIUS is an authentication protocol, SDN is a networking architecture, and SWG focuses on web traffic security rather than simplifying cloud IAM.
Question 37
Thousands of computers were compromised in a breach, but the vulnerability that caused the compromise was detected on only three computers during the latest vulnerability scan. An analyst conducts an after action review to determine why the vulnerability was not detected on more computers. The analyst recreates the following configuration that was used to scan the network:
Which of the following best explains the reason the vulnerability was found only on three computers?
A. Incorrect remote port specified
B. Lack of concurrent threads dedicated
C. Use of a credentialed vulnerability scan
D. Configuring an incorrect subnet mask
Show Answer
Correct Answer: D
Explanation: The scan targeted only 172.16.0.0/24, a range of 256 addresses (typically 254 usable host addresses). If the compromised computers were spread across a larger network, this incorrectly narrow subnet would exclude most of them. The port is set to FTP’s standard port 21, and one thread affects scan speed rather than the target range.
Question 38
An analyst receives alerts that state the following traffic was identified on the perimeter network firewall:
Which of the following best describes the indicator of compromise that triggered the alerts?
A. Anomalous activity
B. Bandwidth saturation
C. Cryptomining
D. Denial of service
Show Answer
Correct Answer: A
Explanation: The logs show unusual traffic from several low-reputation source IPs to one destination, which is consistent with anomalous activity. The small, varied byte counts do not establish bandwidth saturation or a denial-of-service attack, and there is no indication of cryptomining.
Question 38
An organization's Chief Information Security Officer (CISO) is organizing a tabletop drill. The CISO has included several other executives in the meeting invitation for the drill, as required. Which of the following is the best reason for including the Chief Communications Officer?
A. Deciding when and how to issue press releases regarding incidents can minimize damage to the organization's brand reputation.
B. All of the organization's high-level executives should know about the IT department's incident response plan.
C. All parties must be able to communicate clearly. concisely, and consistently during incident response.
D. The CISO would like to increase the security department's visibility to senior executives.
Show Answer
Correct Answer: A
Explanation: The Chief Communications Officer is responsible for managing external communications, media relations, and protecting the organization's public image. During a cybersecurity incident, decisions about when and how to communicate with customers, regulators, and the press are critical to minimizing reputational damage while coordinating with legal and incident response. The other options are either too general or not specific to the CCO's role.
Question 39
A vulnerability scan of a web server that is exposed to the internet was recently completed. A security analyst is reviewing the resulting vector strings:
Which of the following vulnerabilities should be patched first?
A. Vulnerability 1
B. Vulnerability 2
C. Vulnerability 3
D. Vulnerability 4
Show Answer
Correct Answer: A
Explanation: Vulnerability 1 has the highest severity: it is remotely exploitable over the network, requires no privileges or user interaction, and has a high confidentiality impact. Patch it first.
Question 39
An analyst reviews the following web server log entries:
%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd
No attacks or malicious attempts have been discovered. Which of the following most likely describes what took place?
A. A SQL injection query took place to gather information from a sensitive file.
B. A PHP injection was leveraged to ensure that the sensitive file could be accessed.
C. Base64 was used to prevent the IPS from detecting the fully encoded string.
D. Directory traversal was performed to obtain a sensitive file for further reconnaissance.
Show Answer
Correct Answer: D
Explanation: The path '%2E%2E/' is URL-encoded '../', which is used in directory traversal attacks to move up the directory tree. Repeating it before '/etc/passwd' is a classic attempt to access the sensitive Unix password file for reconnaissance. This is not SQL injection, PHP injection, or Base64 encoding.
Question 40
An organization has tracked several incidents that are listed in the following table:
Which of the following is the organization’s MTTD?
A. 140
B. 150
C. 160
D. 180
Show Answer
Correct Answer: C
Explanation: MTTD is the average time elapsed before the incidents were detected. The mean is (180 + 150 + 170 + 140) ÷ 4 = 160 minutes.
Question 41
A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization’s environment. An analyst views the details of these events below:
Which of the following statements best describes the intent of the attacker, based on this one-liner?
A. Attacker is escalating privileges via JavaScript.
B. Attacker is utilizing custom malware to download an additional script.
C. Attacker is executing PowerShell script “AccessToken.ps1”.
D. Attacker is attempting to install persistence mechanisms on the target machine.
Show Answer
Correct Answer: C
Explanation: The one-liner uses rundll32 and JavaScript to launch PowerShell, which downloads AccessToken.ps1 from a remote server and executes its contents in memory using IEX. The command does not establish that custom malware or persistence mechanisms are involved, nor does it show privilege escalation.
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
