100 Free CCNA Cybersecurity 200-201 Practice Questions and Answers

Why A is right

CDFS is the CD File System driver used by Windows for optical CD media. An ISO evidence copy saved in CDFS format therefore points to a CD data copy prepared on a Windows system.

Why C is right

A load balancer with application-layer (Layer 7) capabilities makes routing decisions based on HTTP headers, URIs, and SSL session IDs. This advanced load balancing technique, called content-based or application-aware routing, directs traffic to specific backend servers based on application-level attributes rather than just IP and port information.

Why A is right

Greylisting is an action the mail transfer agent takes at the moment of delivery: when a message arrives from a sender triplet (sending IP, envelope sender, recipient) that the MTA does not recognize, the MTA refuses to accept it and returns a 4xx transient rejection. Nothing is accepted, stored, or delivered at that point, so the behavior is a denial of email from an unrecognized sender. The filtering value comes from that denial, because well behaved mail servers queue the message and retry, while most bulk spam engines never attempt a second delivery. Option A states exactly this denial of mail from a sender the MTA does not recognize.

Why D is right

Identity and access management (IAM) is the framework that controls user access to critical information across heterogeneous technology environments. It encompasses authentication, authorization, and accounting mechanisms to ensure only authorized users can access appropriate resources regardless of the underlying technology platform.

Why C is right

Application-level whitelisting is the security technology that restricts execution to only pre-approved applications. It operates on an allow-list principle where only authorized applications are permitted to run.

Why A is right

Secure boot protects the boot process by verifying firmware and bootloader integrity, preventing malicious code from loading at startup, while restricting USB ports removes a physical attack vector and data exfiltration path. Load balancing distributes network traffic rather than reducing endpoint attack surface, audit log levels increase visibility but don't reduce surface, and packet captures are forensic tools that don't reduce surface.

Why D is right

Secure boot protects the boot process by verifying firmware and bootloader integrity, preventing malicious code from loading at startup, while restricting USB ports removes a physical attack vector and data exfiltration path. Load balancing distributes network traffic rather than reducing endpoint attack surface, audit log levels increase visibility but don't reduce surface, and packet captures are forensic tools that don't reduce surface.

Why A is right

Shellshock is a command injection vulnerability in the Bash shell that allows attackers to inject arbitrary commands through specially crafted environment variables. This vulnerability enables remote code execution when Bash processes unsanitized input, making it a critical command injection flaw.

Why D is right

The Cyber Kill Chain model's delivery stage involves transmitting the weaponized payload to the target. Spear-phishing emails represent the delivery mechanism; the attacker sends targeted, crafted messages to deliver social engineering attacks or malware to the intended victim. Although the user identified it as suspicious before opening it, the email itself constitutes a delivery attempt within the Kill Chain framework.

Why C is right

A buffer overflow attack occurs when data is written beyond the boundaries of a predefined memory buffer, overloading the allocated amount of memory. This excessive data overwrites adjacent memory, potentially corrupting program state, crashing the application, or allowing arbitrary code execution. The attack exploits insufficient bounds checking in memory operations.

Why B is right

Defense-in-depth is a layered security approach using multiple defensive mechanisms. Implementing VLANs to segment network traffic exemplifies this principle by creating isolated network segments that limit lateral movement and contain potential breaches, reducing the attack surface at multiple layers of the network architecture.

Why C is right

An application-level allow list is a whitelisting approach that explicitly permits only specific files or applications to run while denying everything else. This represents the most restrictive and secure posture, where only known-good and necessary components are permitted to execute.

Why C is right

Agent-based protection installs software on each endpoint to detect threats locally, allowing it to collect and analyze all traffic and activities on that specific device without relying on network infrastructure. This local analysis is a key advantage. Higher maintenance costs, centralized platforms, and device management are not inherent benefits of agent-based versus agentless approaches.

Why C is right

Collection is the forensic phase where data related to a specific event is gathered, labeled, and recorded to preserve its integrity. This process ensures evidence remains admissible and maintains the chain of custody.

Why C is right

Command and control (C2) for network-aware malware serves as the communication mechanism through which the malware contacts a remote server to receive new commands, configuration updates, and instructions. This allows attackers to dynamically control infected systems, deploy additional payloads, exfiltrate data, or modify behavior after the initial infection. C2 is essential for advanced malware that requires remote orchestration.

Why C is right

Data integrity verification uses cryptographic message digest algorithms (such as MD5, SHA-1, or SHA-256) to compute hashes of the original and copied data. By comparing these digests, an analyst can confirm that data has not been altered or corrupted during collection, transmission, or storage. If the digests match, the data integrity is verified; if they differ, tampering or corruption has occurred. This is a fundamental forensic technique for ensuring data has been properly preserved and is admissible in investigations.

Why D is right

Reconnaissance is the first step in the cyber kill chain where an attacker gathers information about the target through OSINT, network scanning, and research of online services. This initial information gathering phase precedes all other attack steps.

Why B is right

A distributed denial of service (DDoS) attack using a botnet to reflect requests off NTP servers is specifically called an NTP amplification attack or NTP reflection attack. The botnet sends requests to NTP servers, which reflect amplified responses back to the target, overwhelming it with traffic. This is a distributed attack because it originates from multiple botnet nodes, making it a DDoS rather than a single DoS.

Why D is right

HTTPS uses encryption to protect data in transit, which obscures the content of network traffic from monitoring tools that attempt to inspect packet payloads. Without decryption capabilities or a trusted certificate, monitoring systems cannot see the actual application-layer data or perform deep packet inspection on encrypted sessions, making it the primary difficulty in monitoring HTTPS traffic.

Why D is right

Suspicious registry or system file changes are direct indicators of attack because they show evidence of malware or unauthorized system modification. While options A, B, and C may represent suspicious activities worthy of investigation, they can have legitimate explanations (batch requests for shared files, legitimate multi-region logins, database maintenance). Registry and system file modifications outside of authorized changes indicate compromise or attack.

Why A is right

When an IDS is overwhelmed with false positives and false negatives, the root cause is improper configuration. Modifying the IDS settings, such as adjusting sensitivity thresholds, refining detection rules, and tuning alert parameters, is the primary action to reduce alert noise while maintaining detection accuracy. This addresses the fundamental calibration issue.

Why D is right

Risk avoidance is the risk management approach that eliminates activities or exposures that pose a risk by discontinuing or refusing to engage in the risky activity altogether. This completely removes the risk by not participating in the activity. Risk reduction minimizes impact, risk retention accepts the risk, and risk acknowledgment recognizes the risk without mitigation, none of which involve elimination.

Why A is right

Deterministic analysis assigns specific known values to variables and parameters to calculate exact, predictable outcomes. This approach contrasts with probabilistic analysis, which uses probability distributions and ranges to explore potential outcomes under uncertainty.

Why C is right

Asymmetric cryptography uses a public-private key pair where data encrypted with the public key can only be decrypted with the corresponding private key. This enables secure data transfer because the public key can be freely distributed while the private key remains secret. This fundamental characteristic allows secure communication over untrusted channels and forms the basis for digital signatures and certificate-based authentication, making it ideal for secure data transfer scenarios.

Why B is right

Defense-in-depth employs multiple overlapping security measures to protect systems. Dividing networks into parts (network segmentation) and implementing patch management (reducing exploitable vulnerabilities) are both core defensive measures that create multiple layers of protection, ensuring that compromise of one layer does not expose the entire environment.

Why D is right

Defense-in-depth employs multiple overlapping security measures to protect systems. Dividing networks into parts (network segmentation) and implementing patch management (reducing exploitable vulnerabilities) are both core defensive measures that create multiple layers of protection, ensuring that compromise of one layer does not expose the entire environment.

Why D is right

A botnet is a network of compromised computers (bots) controlled by attackers through command-and-control infrastructure. Botnets are commonly used to conduct distributed denial-of-service (DDoS) attacks by coordinating malicious traffic from thousands of compromised machines simultaneously. This distributed approach amplifies the attack impact beyond what a single machine could achieve.

Why C is right

The principle of least privilege directly reduces risk by ensuring users and accounts have only the minimum access rights needed to perform their job functions. If a low-level user account is compromised, the attacker is restricted to the limited permissions assigned to that account, preventing lateral movement to sensitive systems and data. This minimizes the potential damage from account compromise.

Why A is right

A vulnerability management framework provides a structured, comprehensive approach to identifying vulnerabilities across the organization, removing or patching them, and implementing mitigations to reduce risk. It encompasses the entire lifecycle of vulnerability handling, from discovery through remediation and verification, rather than focusing on a single aspect like scanning or documentation.

Why C is right

A man-in-the-middle (MITM) attack can intercept DHCP communications and inject malicious gateway and DNS server addresses into the lease offered to the client. By spoofing DHCP responses or intercepting legitimate ones, an attacker positions itself between the endpoint and legitimate network resources. This allows the attacker to intercept, monitor, and manipulate all traffic passing through the rogue gateway or redirect DNS queries to malicious servers. The unusual gateway and DNS server addresses indicate an attacker has compromised the DHCP process.

Why A is right

Host-based intrusion detection (HIDS) monitors local system operations and local network access on individual hosts for violations of security policy. It operates at the host level, analyzing system calls, file access, process behavior, and network traffic to and from that specific computer. HIDS can detect attacks that occur locally and generate alerts when policy violations are identified.

Why B is right

DNS and NTP are commonly used in amplification attacks because they respond to queries with much larger responses than the requests, allowing attackers to flood targets with traffic. An attacker spoofs the victim's address and sends queries to these services, which then send large responses to the victim.

Why E is right

DNS and NTP are commonly used in amplification attacks because they respond to queries with much larger responses than the requests, allowing attackers to flood targets with traffic. An attacker spoofs the victim's address and sends queries to these services, which then send large responses to the victim.

Why A is right

In the Diamond Model of Intrusion Analysis, the four vertices are Adversary, Capability, Infrastructure, and Victim. A phishing email represents the capability; the tool or technique used to conduct the attack. The email itself is the attack method/capability that the adversary employs. The adversary is the actor behind the attack, infrastructure refers to the systems used to deliver the attack, and the victim is the target. The phishing email as a specific attack technique is classified as a capability.

Why B is right

According to NIST SP 800-86, volatile data includes information that is stored in RAM and will be lost when power is removed. Login sessions are active, temporary in-memory states that exist only while a user is connected. Dump files (memory dumps) are created from volatile memory contents and represent volatile data snapshots. Both are lost if the system is powered off without proper forensic capture.

Why E is right

According to NIST SP 800-86, volatile data includes information that is stored in RAM and will be lost when power is removed. Login sessions are active, temporary in-memory states that exist only while a user is connected. Dump files (memory dumps) are created from volatile memory contents and represent volatile data snapshots. Both are lost if the system is powered off without proper forensic capture.

Why A is right

The Scope metric in CVSS identifies whether a vulnerability impacts only the vulnerable component or extends to other components and systems. A changed scope indicates that a successful attack can affect resources or functionality beyond the vulnerable component itself, reflecting the broader impact of the vulnerability across an environment.

Why B is right

Tunneling is a technology that encapsulates one protocol within another, allowing data to traverse networks using alternative paths and ports. SSH tunneling specifically enables encrypted SSH traffic to flow over nonstandard ports, disguising or redirecting the communication channel. This technique allows attackers to evade firewall rules and detection by running encrypted traffic over unexpected ports rather than standard SSH port 22.

Why A is right

Application server logs record transaction data, which includes details about business transactions, user activities, and operations processed by the server. Transaction data captures individual events and actions performed within applications, such as logins, data modifications, and query executions. This is the primary data type associated with application server logs in security monitoring.

Why D is right

Untampered images are used for forensic investigations because they maintain their original state and can be verified through hash comparison. Tampered images have been altered and therefore do not maintain their forensic integrity, making them unsuitable for investigations. The hash of an untampered image will match both the stored and computed values, confirming no changes have occurred.

Why B is right

Protocol 41 is IPv6 encapsulation, used to tunnel IPv6 traffic through IPv4 networks. An increase in this protocol indicates systems are tunneling IPv6 packets inside IPv4 datagrams, often to bypass IPv4-only network controls or policies.

Why A is right

Evasion techniques are considered low-bandwidth attacks because they rely on crafting a small number of carefully manipulated packets or requests designed to slip past intrusion detection and prevention systems without triggering alarms. Rather than generating large volumes of traffic, an evasion attack manipulates protocol ambiguities, fragmentation, or encoding to disguise malicious payloads as benign traffic, allowing the attacker to achieve their objective with minimal data transmission. This stealthy, resource-efficient approach is what classifies evasion as a low-bandwidth attack technique, distinguishing it from attacks that require sustained or heavy network traffic to succeed.

Why B is right

A driver's license number is highly sensitive personally identifiable information that uniquely identifies an individual and can be used for identity theft or fraud. It must be strictly safeguarded and is regulated under privacy laws.

Why A is right

A threat actor is any entity, individual, group, or organization, that performs a security attack with the potential to impact business services. This is the standard terminology used in security to describe whoever conducts the attack, regardless of their motivation or sophistication level.

Why B is right

Heartbleed is a buffer over-read vulnerability in OpenSSL's heartbeat extension that allows attackers to read sensitive data from server memory without crashing the service. This results in information disclosure, exposing private keys, session tokens, and other confidential information. While it involves memory access, the primary impact and classification is information disclosure rather than a denial of service, buffer overflow (which typically involves writing beyond bounds), or command injection.

Why D is right

NAT (Network Address Translation) allows a single IP address to represent multiple devices by modifying IP headers in transit. The analyzer observes one IP sending and receiving traffic on behalf of multiple devices; a characteristic behavior of NAT, where internal private IPs are translated to a single public IP for outbound traffic and translated back for inbound traffic.

Why D is right

Reverse engineering is the process of analyzing a system, application, or device to understand how it works without having access to its design specifications or source code. Through techniques like disassembly, debugging, and analysis, an analyst can determine functionality and behavior. This definition precisely matches the question's description of obtaining information about how a system works without knowing its design details.

Why D is right

Both SYN flood and teardrop are classic denial-of-service attacks. SYN flood attacks exploit the TCP three-way handshake by sending numerous SYN packets without completing connections, exhausting server resources. Teardrop is an older DoS attack that sends fragmented IP packets that overlap in ways that cause systems to crash or freeze when reassembled. These are both attack types specifically designed to disrupt service availability through resource exhaustion or system exploitation.

Why E is right

Both SYN flood and teardrop are classic denial-of-service attacks. SYN flood attacks exploit the TCP three-way handshake by sending numerous SYN packets without completing connections, exhausting server resources. Teardrop is an older DoS attack that sends fragmented IP packets that overlap in ways that cause systems to crash or freeze when reassembled. These are both attack types specifically designed to disrupt service availability through resource exhaustion or system exploitation.

Why C is right

Exploitation is the attack phase in the cyber kill chain where an attacker actively leverages a vulnerability to gain access or control. In the kill chain model, action on objectives is the final stage, delivery involves transmitting the payload, and installation means establishing persistence; but exploitation specifically refers to the act of attacking the vulnerability itself.

Why C is right

A 5-tuple (source IP, destination IP, source port, destination port, and protocol) is the standard method used to uniquely identify and track a network session or conversation within logs. This combination creates a unique fingerprint for each distinct communication flow between two endpoints.

Why A is right

Integrity in CVSS measures unauthorized modification or destruction of data. The scenario describes replacing one bank account number with another, which is a direct modification of data without authorization, making it an integrity violation.

Why C is right

The average time to detect and resolve incidents is the most comprehensive metric for evaluating SOC effectiveness and scope, as it directly measures the SOC's ability to identify threats and remediate them, which reflects overall operational success.

Why A is right

MTTC (Mean Time to Contain) measures the average time from when an incident is recognized until the organization successfully stops or contains the attack. This metric is critical for understanding how quickly a SOC can respond to and halt ongoing security incidents, directly reflecting the effectiveness of incident response procedures.

Why C is right

Zero Trust is a security model that assumes breach is inevitable and treats both internal and external threats as potential risks. It enforces strict verification and authentication for every access request before granting connection or resource access, regardless of whether the requester is inside or outside the network perimeter. This model eliminates implicit trust based on network location.

Why B is right

Threat intelligence provides current, actionable information about threats actively targeting an organization, including adversary tactics, techniques, and indicators of compromise. This is the primary resource organizations use to understand the specific threats they face.

Why A is right

Symmetric encryption is computationally faster than asymmetric encryption because both encryption and decryption use the same key and simpler mathematical operations. This speed advantage makes symmetric encryption ideal for encrypting large amounts of data during active sessions.

Why A is right

A timing attack is an evasion method where an attacker performs actions at a slower-than-normal rate to evade detection systems and monitoring. By reducing the speed of malicious activities, attackers can bypass threshold-based alerts and anomaly detection that rely on detecting abnormal activity rates.

Why C is right

The two primary types of cross-site scripting (XSS) attacks are reflected and stored. Reflected XSS occurs when malicious scripts are reflected off a web server in response to a user request, typically through URL parameters, without being stored. Stored XSS occurs when malicious scripts are persisted in a database and executed whenever users retrieve the data. Option A (directed) is not a standard XSS category. Option B (encoded) describes an encoding technique rather than an attack type. Option E (cascaded) is not a recognized XSS classification.

Why D is right

The two primary types of cross-site scripting (XSS) attacks are reflected and stored. Reflected XSS occurs when malicious scripts are reflected off a web server in response to a user request, typically through URL parameters, without being stored. Stored XSS occurs when malicious scripts are persisted in a database and executed whenever users retrieve the data. Option A (directed) is not a standard XSS category. Option B (encoded) describes an encoding technique rather than an attack type. Option E (cascaded) is not a recognized XSS classification.

Why D is right

Fragmentation is an evasion technique where traffic is separated into smaller segments before transmission across the network. This can bypass detection systems that operate on complete packets, as reassembly may occur after inspection or inspection tools may not properly reconstruct fragmented data.

Why D is right

Defense in depth is a layered security strategy in which multiple, independent controls are placed throughout a network so that if one layer fails, others still provide protection. Isolating guest Wi-Fi from the local network is a classic example of this principle: it creates a segmentation layer that prevents untrusted guest traffic from directly reaching internal, trusted resources, adding an additional barrier beyond perimeter defenses like firewalls. This kind of network segmentation embodies the core idea of defense in depth; using multiple, overlapping layers of protection rather than relying on a single control point.

Why B is right

Creating a separate VLAN to isolate networks exemplifies defense-in-depth by implementing network segmentation as a security layer. This isolates critical assets and limits lateral movement, creating a multi-layered protective boundary. It is a concrete technical control that reduces attack surface and contains breaches.

Why A is right

In the digital forensics process, the examination phase is where tools and techniques are applied to extract, analyze, and interpret information from collected data. During examination, forensic analysts use specialized software and methodologies to search for, recover, and analyze artifacts like deleted files, metadata, logs, and other evidence from storage devices and memory. The collection phase gathers data, investigation involves the broader inquiry, and reporting documents findings.

Why D is right

DNS tunneling is a technique that encapsulates data within DNS queries and responses, allowing an attacker to exfiltrate data through DNS protocol. The high frequency of DNS requests in a small period of time is characteristic of DNS tunneling, where legitimate-looking DNS traffic is used as a covert channel to extract data from a network. This behavior exploits the fact that DNS is typically allowed through firewalls and is often not closely monitored.

Why C is right

Mean Time to Contain (MTTC) measures the duration from when an incident is detected until it is contained, preventing further damage to systems and data. By comparison, MTTA measures the time to acknowledge an alert, Mean Time to Respond measures the time to respond to an incident, and Mean Time to Detect measures the time to discover it. MTTC specifically focuses on stopping the incident's impact and limiting additional harm, which directly addresses the question of halting further damage.

Why A is right

Inline traffic inspection acts directly on the original traffic data flow, allowing it to block or modify traffic in real-time before it reaches its destination. Traffic mirroring (SPAN, tap) creates a copy of traffic sent to a monitoring tool for analysis without affecting the original traffic flow. The key difference is that inline inspection operates on the actual traffic and can take action, while mirroring only observes. Options B, C, and D mischaracterize the capabilities and differences between these two methods.

Why B is right

A command and control (C2 or C&C) channel is the communication pathway established between a compromised machine and an attacker's server. This allows the attacker to send commands to the infected system, retrieve stolen data, deploy additional malware, or maintain persistent access. C2 is fundamental to most advanced malware operations.

Why D is right

A man-in-the-middle (MITM) attack occurs when an attacker eavesdrops on communications between two parties, intercepting and potentially modifying the conversation between two IP phones. Known-plaintext and dictionary attacks are cryptographic attacks, while replay attacks involve retransmitting captured messages rather than live eavesdropping.

Why D is right

Full packet capture stores the complete content of every packet traversing the network, including payload data, headers, and metadata. This creates massive storage requirements. A 1 Gbps network can generate terabytes of packet data daily. Alert data contains only triggered security events. Transaction data logs summarized business activities. Session data tracks connection summaries. All three alternatives store aggregated or summary information, requiring far less storage than capturing raw packet data in full.

Why A is right

This scenario presents both a vulnerability (known issues that trigger adware) and a threat (a new incident that could harm the system). A vulnerability is a weakness in the system, while a threat is the potential harm or attack that could exploit that weakness. The security engineer must protect against the known vulnerability while defending against the emerging threat. Risk, exploit, patching, evidence, analysis, and remediation are secondary concepts not central to this scenario's core concern.

Why B is right

Network Address Translation (NAT) hides internal IP addresses by translating them to external addresses during network communication. This reduces data visibility by obscuring the true source addresses of internal hosts from external observers. NAT acts as a privacy and security tool by making internal network structure and individual device addresses less visible to outside networks.

Why D is right

A file hash (such as MD5, SHA-1, or SHA-256) provides a unique cryptographic fingerprint of a file's contents. Hashes are deterministic and collision-resistant, making them the standard method for uniquely identifying files in security contexts. File timestamps, extensions, and sizes can all change or be duplicated across different files, making them unreliable for unique identification.

Why B is right

Full packet capture provides complete visibility into the actual data content transferred during network sessions, allowing investigators to confirm whether sensitive data was extracted and transmitted. This granular visibility is essential to definitively prove data exfiltration occurred.

Why C is right

Internet exposed devices is a key vulnerability management metric that measures the number and scope of organizational assets exposed to the internet, indicating potential attack surface and security risk exposure that needs monitoring and remediation.

Why D is right

CDFS (CD File System) is the file system driver Windows uses to read and present optical CD media. An ISO image stored in CDFS format therefore indicates the evidence is data from a CD that was copied on a Windows system.

Why B is right

Host-based firewalls operate at the application and transport layers of the OSI model, filtering network traffic based on ports, protocols, and connection rules. They protect workstations from unwanted network traffic by allowing or blocking connections according to defined policies. While viruses, zero-day vulnerabilities, and malicious scripts are security threats, they are not the primary function of host-based firewalls; antivirus software, patches, and application-level controls address those threats respectively.

Why D is right

A false positive occurs when a security signature incorrectly identifies legitimate traffic as malicious and blocks it. In this scenario, the signature impacts network traffic by blocking legitimate connections. A false positive is the incorrect flagging of benign activity as a threat. A false negative misses actual attacks. A true positive correctly identifies genuine threats. A true negative correctly permits legitimate traffic.

Why A is right

DDoS (Distributed Denial of Service) attacks are categorized into two main types: direct attacks and reflected attacks. Direct DDoS attacks involve the attacker sending traffic directly to the target from multiple sources. Reflected DDoS attacks involve the attacker sending requests to third-party servers that then reflect traffic toward the actual target, obscuring the attack's origin. Split brain, scanning, and phishing are not categories of DDoS attacks; split brain relates to cluster systems, scanning is reconnaissance, and phishing is a social engineering attack vector.

Why B is right

DDoS (Distributed Denial of Service) attacks are categorized into two main types: direct attacks and reflected attacks. Direct DDoS attacks involve the attacker sending traffic directly to the target from multiple sources. Reflected DDoS attacks involve the attacker sending requests to third-party servers that then reflect traffic toward the actual target, obscuring the attack's origin. Split brain, scanning, and phishing are not categories of DDoS attacks; split brain relates to cluster systems, scanning is reconnaissance, and phishing is a social engineering attack vector.

Why D is right

TOR (The Onion Router) encrypts and routes traffic through multiple nodes, obscuring the source, destination, and content of communications. From an organizational perspective, this significantly decreases visibility into network traffic and user activities. Organizations cannot easily monitor or inspect TOR traffic to identify data exfiltration, malicious communications, or policy violations. While TOR may increase security for individual privacy, it reduces organizational visibility and control over data flows.

Why A is right

Statistical data is used to establish baselines and patterns within network operations, enabling the detection of anomalies when actual behavior deviates from expected statistical norms. Statistical analysis allows security teams to identify unusual network patterns, traffic flows, and activities. This approach relies on quantitative data and mathematical models to detect abnormal behavior compared to historical patterns and established baselines.

Why A is right

A full packet capture includes both the complete header information (source/destination addresses, ports, protocol details) and the full payload (application data) of network communications. This comprehensive data allows engineers to reconstruct sessions, analyze protocols, and identify malicious content or behavior. Frame check sequence is only error detection; alert data and session logs are summaries or outputs derived from analysis, not the raw capture needed for detailed payload and header examination.

Why C is right

Containment is the hands-on phase where infected hosts are isolated from the network before the ransomware spreads further, so the stakeholders needed are the people who touch the affected machines. The Incident Response Team Engineers perform the technical work: quarantining the company-owned endpoints, blocking the phishing sender and malicious domains, capturing volatile evidence, and segmenting the affected subnet. The owners of the infected endpoints are equally necessary because they confirm which message was opened, identify what data and shares the host reached, report symptoms, and authorize taking their workstation offline. Together these two groups supply the operational knowledge and the technical execution that containment of a phishing-delivered ransomware outbreak requires.

Why D is right

Containment is the hands-on phase where infected hosts are isolated from the network before the ransomware spreads further, so the stakeholders needed are the people who touch the affected machines. The Incident Response Team Engineers perform the technical work: quarantining the company-owned endpoints, blocking the phishing sender and malicious domains, capturing volatile evidence, and segmenting the affected subnet. The owners of the infected endpoints are equally necessary because they confirm which message was opened, identify what data and shares the host reached, report symptoms, and authorize taking their workstation offline. Together these two groups supply the operational knowledge and the technical execution that containment of a phishing-delivered ransomware outbreak requires.

Why C is right

According to the Cyber Kill Chain model, reconnaissance is the first phase where attackers gather information about their targets. Port scanning is a classic reconnaissance activity used to identify active hosts, open ports, services, and system configurations. The attacker is still in the intelligence-gathering phase before attempting any exploitation or delivery of malicious payload.

Why B is right

Rule-based detection uses predetermined rules to identify specific patterns or signatures of known malicious behavior, providing definitive proof when a rule is triggered. This contrasts with statistical detection, which calculates the likelihood of an action based on deviation from normal behavior. Rule-based detection establishes whether an action occurred (proof), while statistical detection estimates probability.

Why B is right

Availability refers to the assurance that data and systems are accessible and functional for authorized users when needed. The concept of data being consistently and readily accessible for legitimate users is the core definition of availability, one of the three pillars of the CIA triad (Confidentiality, Integrity, Availability).