A security analyst notices an increase in port scans on the edge of the corporate network. Which of the following logs should the analyst check to obtain the attacker’s source IP address?
A. OS security
B. Firewall
C. Application
D. Endpoint
Show Answer
Correct Answer: B
Explanation: Firewall logs are the appropriate source because they record inbound and outbound network connection attempts at the network perimeter, including source IP addresses, destination ports, protocols, and allowed/blocked actions. These logs are the primary place to identify the external source IP responsible for port scans. OS security, application, and endpoint logs are not the primary source for edge network reconnaissance events.
Question 8
A security analyst is reviewing the logs on an organization's DNS server and notices the following unusual snippet:
Which of the following attack techniques was most likely used?
A. Determining the organization's ISP-assigned address space
B. Bypassing the organization's DNS sinkholing
C. Footprinting the internal network
D. Attempting to achieve initial access to the DNS server
E. Exfiltrating data from fshare.int.complia.org
Show Answer
Correct Answer: C
Explanation: The AXFR query requests a DNS zone transfer, which can disclose a domain’s DNS records, including hostnames and internal IP addresses. This information helps an attacker map or footprint the internal network.
Question 8
An administrator wants to automate an account permissions update for a large number of accounts. Which of the following would best accomplish this task?
A. Security groups
B. Federation
C. User provisioning
D. Vertical scaling
Show Answer
Correct Answer: C
Explanation: User provisioning can automate changes to existing accounts, including their permissions, across a large number of users. Security groups simplify assigning shared permissions, but do not themselves automate the account-update process.
Sources:
https://learn.microsoft.com/en-us/graph/whats-new-earlier
Question 9
A retail company receives a request to remove a customer's data. Which of the following is the retail company considered under GDPR legislation?
A. Data processor
B. Data controller
C. Data subject
D. Data custodian
Show Answer
Correct Answer: B
Explanation: Under GDPR, a data controller determines the purposes and means of processing personal data. A retail company that collects and manages customer information for its own business decides why and how the data is processed and is responsible for responding to data subject rights requests such as erasure. A data processor acts on behalf of a controller, the data subject is the individual whose data is processed, and 'data custodian' is not the GDPR role in question.
Question 9
A systems administrator notices that a testing system is down. While investigating, the systems administrator finds that the servers are online and accessible from any device on the server network. The administrator reviews the following information from the monitoring system:
Which of the following is the most likely cause of the outage?
A. Denial of service
B. ARP poisoning
C. Jamming
D. Kerberoasting
Show Answer
Correct Answer: A
Explanation: The two test servers are down and show extremely high traffic received compared with the other servers, which is consistent with a denial-of-service attack overwhelming those systems.
Question 9
Which of the following options will provide the lowest RTO and RPO for a database?
A. Snapshots
B. On-site backups
C. Journaling
D. Hot site
Show Answer
Correct Answer: D
Explanation: A hot site is already operational and can be kept synchronized with the primary database, enabling rapid failover (low RTO) with minimal data loss (low RPO). Journaling can reduce data loss, but recovering by replaying logs may take time and does not itself provide an immediately available standby.
Question 10
Which of the following should an organization use to ensure that it can review the controls and performance of a service provider or vendor?
A. Service-level agreement
B. Memorandum of agreement
C. Right-to-audit clause
D. Supply chain analysis
Show Answer
Correct Answer: C
Explanation: A right-to-audit clause contractually grants an organization the ability to inspect and assess a service provider's controls, processes, compliance, and performance. A service-level agreement defines expected service performance but does not itself guarantee audit rights. A memorandum of agreement outlines cooperation, and supply chain analysis is a risk assessment activity, not a contractual mechanism for audits.
Question 10
An employee who was working remotely lost a mobile device containing company data. Which of the following provides the best solution to prevent future data loss?
A. MDM
B. DLP
C. FDE
D. EDR
Show Answer
Correct Answer: A
Explanation: MDM is the best overall solution for company data on mobile devices. It can enforce encryption and other security policies in advance and remotely lock or wipe a device if it is lost. FDE protects stored data, but it is only one of the controls MDM can enforce.
Sources:
https://www.progress.com/blogs/how-to-prevent-mobile-data-loss
https://www.cybersecurityintelligence.com/blog/safeguarding-your-business-10-best-practices-for-mobile-device-safety-8039.html
Question 10
An administrator is reviewing a single server's security logs and discovers the following:
Which of the following best describes the action captured in this log file?
A. Brute-force attack
B. Privilege escalation
C. Failed password audit
D. Forgotten password by the user
Show Answer
Correct Answer: A
Explanation: The log records repeated failed logon attempts (Windows Event ID 4625) occurring every few seconds, a pattern consistent with a brute-force attack.
Question 11
A systems administrator is advised that an external web server is not functioning property. The administrator reviews the following firewall logs containing traffic going to the web server:
Which of the following attacks is likely occurring?
A. DDoS
B. Directory traversal
C. Brute-force
D. HTTPS downgrade
Show Answer
Correct Answer: A
Explanation: The firewall logs show multiple SYN requests from different source IP addresses targeting the same web server on port 443 at the same time. This pattern is consistent with a SYN-flood distributed denial-of-service (DDoS) attack, which can exhaust the server’s connection resources.
$19
Get all 609 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
