30 Free CySA+ CS0-004 Practice Questions and Answers
30 questions for the CySA+ CS0-004 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Forensic preservation is done once a compromise is confirmed, and nothing has been confirmed here.
Right, B is the answer.
Why B is right
Without a patch the weakness stays open, so the sensible step is to learn at once if anyone tries to use it. Watching for the advisory's indicators provides that early warning and covers the gap until the maker ships a fix.
Not this one. Try another answer.
Why C is wrong
Redirecting domains changes where bad traffic lands but leaves the unpatched flaw in place.
Not this one. Try another answer.
Why D is wrong
Cleaning out footholds only makes sense if an intruder is already present, and no breach has been shown.
Question 2 Play from 01:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Privileged access tooling controls administrator sessions and does not remove secrets embedded in an application.
Right, B is the answer.
Why B is right
Embedded credentials get copied into every clone, build and backup of the code. A secrets manager keeps the value outside the code, hands it over when the program runs, and supports rotation and audit trails, so nothing sensitive stays in the repository.
Not this one. Try another answer.
Why C is wrong
Single sign-on deals with how people log in, not with machine secrets stored in code.
Not this one. Try another answer.
Why D is wrong
Encoding or masking a key only hides it from a casual glance, and the secret still sits in the repository.
Question 3 Play from 03:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The data protection log relates to key protection for cryptography, not to scripts being run.
Not this one. Try another answer.
Why B is wrong
The device installation log records hardware and driver activity.
Right, C is the answer.
Why C is right
Fileless malware lives in memory, and on Windows it usually drives PowerShell. To record it, the PowerShell operational log must be enabled with script block and module logging, because by default Windows notes that PowerShell started but not what it executed.
Not this one. Try another answer.
Why D is wrong
The Terminal Services session log tracks remote desktop sessions, not script content.
Question 4 Play from 05:05
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
ScoutSuite audits a cloud environment by calling the provider's APIs, then compares the settings it finds with security baselines for each account and service. That is what a cloud baseline review needs; the other tools target hosts, web servers or exploitation.
Not this one. Try another answer.
Why B is wrong
OpenVAS scans hosts and network services, not cloud control plane settings.
Not this one. Try another answer.
Why C is wrong
Nikto tests web servers for known problems and misconfigurations.
Not this one. Try another answer.
Why D is wrong
Metasploit is an exploitation framework, not a configuration assessment tool.
Question 5 Play from 06:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Nothing was taken out of service, so there is nothing to restore.
Not this one. Try another answer.
Why B is wrong
The review comes after a response is finished, so it is not what was missed.
Not this one. Try another answer.
Why C is wrong
The analyst did examine the link and confirm the visit, so analysis took place.
Right, D is the answer.
Why D is right
The analyst proved the link was built to harvest passwords and that the employee loaded it, yet closed the ticket without acting on the account. Containment limits harm while that is still possible, for example by resetting the password and ending active sessions. Closing the case because no misuse was seen leaves the exposed credential live.
Question 6 Play from 08:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
That would need an attacker to craft input aimed at steering the model, and nobody did that here.
Right, B is the answer.
Why B is right
A hallucination happens when a model produces confident, believable output that has no basis in what it was given, such as invented events. The fabrication comes from the model's own generation, not from tampered training data or a hostile instruction.
Not this one. Try another answer.
Why C is wrong
Exposure means information leaking out, not information being made up.
Not this one. Try another answer.
Why D is wrong
Poisoning is a deliberate corruption of training data, which is an attack and not this fault.
Question 7 Play from 09:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A penetration test probes systems for technical flaws, not the decision paths in the plan.
Not this one. Try another answer.
Why B is wrong
Awareness training teaches staff in general terms and does not exercise the plan.
Right, C is the answer.
Why C is right
In a tabletop exercise the participants walk through an invented incident and discuss who decides what. That reveals gaps in roles, decisions and communication, and since it is discussion based, senior and non-technical people can join easily.
Not this one. Try another answer.
Why D is wrong
A red team attacks to test technical detection and response, rather than letting stakeholders talk through the plan.
Question 8 Play from 11:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
SASE delivers security controls from a distributed cloud service and applies them to each user and session wherever they are. Access stops depending on sitting inside a network boundary, so the design has no perimeter.
Not this one. Try another answer.
Why B is wrong
Content delivery networks place content near users for speed and do not enforce access.
Not this one. Try another answer.
Why C is wrong
A hybrid cloud still ties environments together across defined boundaries.
Not this one. Try another answer.
Why D is wrong
Cloud-native describes how applications are built and deployed, not how access is secured.
Question 9 Play from 12:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A credentialed scan looks deeper but still runs only on its schedule.
Not this one. Try another answer.
Why B is wrong
A network scan looks at services over the wire and also follows the schedule.
Not this one. Try another answer.
Why C is wrong
An external scan checks internet-facing exposure and would not see an internal setting change.
Right, D is the answer.
Why D is right
An agent sits on the host and checks it against current vulnerability data all the time, so a change in settings is noticed right away. Scans that run on a timetable would have found nothing at their last run, which matches what the analyst saw.
Question 10 Play from 14:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The review happens only after the response is complete.
Not this one. Try another answer.
Why B is wrong
Preparation is done before any incident occurs.
Not this one. Try another answer.
Why C is wrong
The incident was identified two weeks ago, so detection is behind them.
Right, D is the answer.
Why D is right
Services are still down and malware remains on some systems, so removing the attacker is not finished. That is the eradication phase, which lasts until every affected host is clean, however long that takes.
Not this one. Try another answer.
Why E is wrong
The team already knows what happened and is now acting on it.
Show all 30 questionsShow fewer questions
Question 11 Play from 15:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Hashes and addresses are the cheapest things for an attacker to swap out.
Right, B is the answer.
Why B is right
TTPs describe how an adversary works, not just what traces were left behind. Addresses and file hashes change as soon as infrastructure is rebuilt, whereas the underlying behavior is expensive to alter and recurs from one campaign to the next. Defending against behavior therefore still works after indicators have changed.
Not this one. Try another answer.
Why C is wrong
Tools can be exchanged for similar ones without altering how the adversary works.
Not this one. Try another answer.
Why D is wrong
Indicators are leftovers from an attack, not the behavior that produced it.
Question 12 Play from 17:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Transference moves the loss to someone else, for example through insurance.
Not this one. Try another answer.
Why B is wrong
Acceptance would mean keeping the system running and living with the exposure.
Right, C is the answer.
Why C is right
When the system is removed, the activity that created the risk is gone, which is exactly what avoidance means. With the system retired, no leftover exposure has to be managed.
Not this one. Try another answer.
Why D is wrong
Mitigation lowers the likelihood or impact but leaves the system in use.
Question 13 Play from 18:45
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A simulated phish tests whether people spot and resist a lure, and the click rate shows the share who did not. It therefore gauges employee awareness and points to who needs extra training.
Not this one. Try another answer.
Why B is wrong
False positives in a data loss tool are a tuning metric for a different control.
Not this one. Try another answer.
Why C is wrong
Reaction speed is measured by time to report or respond, not by clicks.
Not this one. Try another answer.
Why D is wrong
Filter performance shows in what the gateway blocked, not in what recipients did.
Question 14 Play from 20:17
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A recurring call with the people doing the work is a coordination tool. It lets the analyst see how tasks flow and what skills exist, and keeps everyone aligned as the project proceeds, so the purpose is coordination rather than training or gathering requirements.
Not this one. Try another answer.
Why B is wrong
Training follows a set curriculum and would not reveal how the team works.
Not this one. Try another answer.
Why C is wrong
Vendor briefings involve outside suppliers who are not on the task force.
Not this one. Try another answer.
Why D is wrong
Customer requirements are external work handled elsewhere.
Question 15 Play from 21:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Inherent risk is the level before any safeguards are applied.
Not this one. Try another answer.
Why B is wrong
Appropriate is not a recognized category of risk.
Right, C is the answer.
Why C is right
Residual risk is what remains after controls are in place, since no safeguard brings exposure to zero. The organization has to accept, watch, or further treat that remainder.
Not this one. Try another answer.
Why D is wrong
Acceptable risk is the tolerated threshold, not the measured leftover.
Question 16 Play from 22:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A memorandum of understanding records shared intent and normally is not binding or tied to measurable targets.
Not this one. Try another answer.
Why B is wrong
A payback analysis justifies spending inside the company.
Not this one. Try another answer.
Why C is wrong
A risk plan describes how risk is handled and does not commit to service levels.
Not this one. Try another answer.
Why D is wrong
A catalog of adversary behaviors describes attackers and is not a contract.
Right, E is the answer.
Why E is right
A service-level agreement is the contract between a provider and a customer that fixes the promised service and the performance indicators used to measure it. Breach is judged against those targets, and signatures from both sides fit this document.
Question 17 Play from 24:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Root cause analysis explains why it happened and forms one section of the larger report.
Right, B is the answer.
Why B is right
An after action report is the full record created when an incident ends. It gathers the timeline, cause, response steps, impact and lessons into one document, so it is broader than any single review output.
Not this one. Try another answer.
Why C is wrong
A situation report is a progress update issued while the incident is still going.
Not this one. Try another answer.
Why D is wrong
Lessons learned lists improvements and is just one part of the full report.
Question 18 Play from 26:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
TLS-protected requests are identified as TLS, not HTTP, so the filter leaves them out.
Not this one. Try another answer.
Why B is wrong
Since encrypted web traffic is not matched, the output cannot contain both kinds.
Right, C is the answer.
Why C is right
The filter keeps frames dissected as HTTP plus every UDP packet. HTTP is unencrypted web traffic, and DNS normally travels over UDP, so the result is clear web requests along with DNS. HTTPS rides on TLS over TCP, so it satisfies neither condition.
Not this one. Try another answer.
Why D is wrong
The filter matches plenty of packets; it does not exclude everything.
Question 19 Play from 27:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A closed system limits access, but its operator can still apply patches.
Not this one. Try another answer.
Why B is wrong
Controlled systems sit behind change management, which slows fixes but does not stop them.
Not this one. Try another answer.
Why C is wrong
Shared systems make scheduling harder because many owners must agree, but a fix still exists.
Right, D is the answer.
Why D is right
Legacy systems often have no fix to apply: the vendor has dropped support, no patch will come, and the platform may not accept one anyway. The organization is left with workarounds in place of remediation, which is exactly what blocks it.
Question 20 Play from 29:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A dashboard changes how results look, not whether the rule is accurate.
Right, B is the answer.
Why B is right
A notification that does not match reality points to a detection rule that needs adjusting. Alert tuning refines the logic and thresholds so the rule stops misfiring, which solves the cause instead of handling its output again and again.
Not this one. Try another answer.
Why C is wrong
Enrichment adds context to an alert, but a wrong alert with context is still wrong.
Not this one. Try another answer.
Why D is wrong
Hunting looks proactively for undetected activity and does not repair a faulty rule.
Question 21 Play from 30:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A fully fixed and deployed flaw needs no substitute control.
Not this one. Try another answer.
Why B is wrong
A confirmed false positive carries no actual risk to offset.
Right, C is the answer.
Why C is right
A compensating control stands in when the preferred control cannot be applied. That happens when a flaw cannot be patched and the system is too important to turn off, so the organization lowers exposure through other means.
Not this one. Try another answer.
Why D is wrong
A company that does not use the product has no exposure to compensate for.
Question 22 Play from 32:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Storage and containment keeps evidence safe but does not record who handled it.
Not this one. Try another answer.
Why B is wrong
Packaging and labeling is one physical step within the larger custody process.
Not this one. Try another answer.
Why C is wrong
Post-incident reporting summarizes the event afterward.
Right, D is the answer.
Why D is right
Chain of custody is a written log of who handled each piece of evidence, when and why, kept unbroken from the point of collection. That log is what lets the evidence stand up later.
Question 23 Play from 33:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Execution means running code on a target.
Not this one. Try another answer.
Why B is wrong
Credential access is stealing credentials, which has already happened here.
Right, C is the answer.
Why C is right
The attacker already controls a role and is using it to reach another environment. Moving between systems or environments with access already gained is lateral movement; the goal is wider reach, not more rights in the same place.
Not this one. Try another answer.
Why D is wrong
Privilege escalation means gaining higher permissions, not using current access to go elsewhere.
Not this one. Try another answer.
Why E is wrong
Persistence is about keeping access across restarts and credential changes.
Question 24 Play from 35:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
OpenCTI stores and links threat data that is already structured and is not meant for extracting from raw text.
Right, B is the answer.
Why B is right
CyberChef transforms and extracts data from unstructured text using chained operations, including a recipe that finds IPv4 addresses in any content. The source is a document rather than captured traffic, so an extraction tool is the right instrument.
Not this one. Try another answer.
Why C is wrong
Wireshark analyzes packet captures and cannot parse a text report.
Not this one. Try another answer.
Why D is wrong
Zeek produces logs from network traffic, not from written documents.
Question 25 Play from 36:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Open-source intelligence comes from public material at no charge.
Not this one. Try another answer.
Why B is wrong
Threat modeling is a design-time analysis method, not a feed.
Right, C is the answer.
Why C is right
Closed-source intelligence is created and sold by a vendor to paying customers, with restricted distribution. The paid relationship and limited access describe a subscription feed tailored to an industry.
Not this one. Try another answer.
Why D is wrong
Threat mapping relates threats to assets or techniques and is an activity rather than a feed type.
Question 26 Play from 37:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An org chart shows reporting lines, not incident roles or ways to reach people.
Not this one. Try another answer.
Why B is wrong
A past report describes an earlier event and is not kept as a contact directory.
Not this one. Try another answer.
Why C is wrong
Standard operating procedures explain how tasks are done, not who must be notified.
Right, D is the answer.
Why D is right
The communication plan is the part of the response plan that lists who has to be told, in what order, over which channel, and how to reach them. Having that ready beforehand matters, because mid-incident is the worst moment to hunt for phone numbers.
Question 27 Play from 39:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Detection only identifies that an intrusion is happening.
Right, B is the answer.
Why B is right
Eradication removes the attacker and everything left behind, such as rogue accounts, implants, scheduled tasks and altered binaries. Containment merely limits reach while the intruder is still present, whereas eradication ends the access for good.
Not this one. Try another answer.
Why C is wrong
Denial of service is a type of attack, not a response phase.
Not this one. Try another answer.
Why D is wrong
Containment restricts what the attacker can reach without removing them.
Question 28 Play from 40:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Performance measures show how the response did but not what to change.
Right, B is the answer.
Why B is right
The review held after closure asks what worked, what failed and what should change in future. Its product is a set of improvements to the way the team responds.
Not this one. Try another answer.
Why C is wrong
An executive summary condenses the incident for leadership.
Not this one. Try another answer.
Why D is wrong
Root cause analysis explains why the incident happened, not how the response could improve.
Question 29 Play from 42:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SASE delivers network security from the cloud and says nothing about timestamps.
Not this one. Try another answer.
Why B is wrong
Account federation unifies identity across systems, not time.
Not this one. Try another answer.
Why C is wrong
ZTNA governs how access is granted.
Right, D is the answer.
Why D is right
Correlating events across many systems only works if their timestamps mean the same thing. With unsynchronized clocks, records from different hosts cannot be ordered reliably and investigators can misjudge cause and sequence, so NTP underpins accurate correlation.
Not this one. Try another answer.
Why E is wrong
APIs move data between tools but do not make its timestamps comparable.
Question 30 Play from 43:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Compliance often follows from encrypting, but the security purpose is protection against disclosure.
Not this one. Try another answer.
Why B is wrong
A signed-in user with the drive unlocked can still copy files, so encryption does not prevent it.
Right, C is the answer.
Why C is right
Disk encryption protects data once a device leaves its owner's hands. A thief with a laptop has unlimited physical access and could remove the drive to read it, but encrypted contents stay unreadable. Preventing disclosure after theft is the aim of encryption at rest.
Not this one. Try another answer.
Why D is wrong
Encryption provides confidentiality, and integrity relies on other mechanisms.
Transcript
Play from 00:00 Question 1. A retail company's analysts read a public advisory listing indicators of compromise for attackers abusing a zero-day flaw. The software maker has not released a fix. What should the team do until a patch arrives? Here are the options. Option A. Preserving forensic images of the affected machines. Option B. Watching continuously for the published indicators. Option C. Redirecting known hostile domains to a controlled server. Option D. Cleaning attacker footholds off hosts. Pause the video now if you want time to think about the answer.
The correct answer is B. Watching continuously for the published indicators. Without a patch the weakness stays open, so the sensible step is to learn at once if anyone tries to use it. Watching for the advisory's indicators provides that early warning and covers the gap until the maker ships a fix. Now, why are the other options incorrect? Option A is incorrect. Forensic preservation is done once a compromise is confirmed, and nothing has been confirmed here. Option C is incorrect. Redirecting domains changes where bad traffic lands but leaves the unpatched flaw in place. Option D is incorrect. Cleaning out footholds only makes sense if an intruder is already present, and no breach has been shown. Therefore, B, Watching continuously for the published indicators, is the correct answer.
Play from 01:39 Question 2. A static code scan of a payment application reports passwords written directly into the source files. What should the reviewer tell the developers to do? Here are the options. Option A. Deploy a privileged access management product for administrators. Option B. Store the credentials in a managed vault that the application queries at runtime. Option C. Turn on single sign-on for the application's users. Option D. Mask the service keys with encoding inside the code. Pause the video now if you want time to think about the answer.
The correct answer is B. Store the credentials in a managed vault that the application queries at runtime. Embedded credentials get copied into every clone, build and backup of the code. A secrets manager keeps the value outside the code, hands it over when the program runs, and supports rotation and audit trails, so nothing sensitive stays in the repository. Now, why are the other options incorrect? Option A is incorrect. Privileged access tooling controls administrator sessions and does not remove secrets embedded in an application. Option C is incorrect. Single sign-on deals with how people log in, not with machine secrets stored in code. Option D is incorrect. Encoding or masking a key only hides it from a casual glance, and the secret still sits in the repository. Therefore, B, Store the credentials in a managed vault that the application queries at runtime, is the correct answer.
Play from 03:28 Question 3. A SOC engineer wants the SIEM to record fileless malware that runs in memory and never writes to disk. Which Windows log needs extra configuration to capture that activity? Here are the options. Option A. The Windows data protection API operational log. Option B. The Windows device installation log. Option C. The Windows PowerShell operational log. Option D. The Windows Terminal Services local session manager operational log. Pause the video now if you want time to think about the answer.
The correct answer is C. The Windows PowerShell operational log. Fileless malware lives in memory, and on Windows it usually drives PowerShell. To record it, the PowerShell operational log must be enabled with script block and module logging, because by default Windows notes that PowerShell started but not what it executed. Now, why are the other options incorrect? Option A is incorrect. The data protection log relates to key protection for cryptography, not to scripts being run. Option B is incorrect. The device installation log records hardware and driver activity. Option D is incorrect. The Terminal Services session log tracks remote desktop sessions, not script content. Therefore, C, The Windows PowerShell operational log, is the correct answer.
Show full transcriptShow less
Play from 05:05 Question 4. An analyst has to run a baseline security review of the organization's cloud accounts. Which tool fits this job best? Here are the options. Option A. ScoutSuite. Option B. OpenVAS vulnerability scanner. Option C. Nikto. Option D. Metasploit. Pause the video now if you want time to think about the answer.
The correct answer is A. ScoutSuite. ScoutSuite audits a cloud environment by calling the provider's APIs, then compares the settings it finds with security baselines for each account and service. That is what a cloud baseline review needs; the other tools target hosts, web servers or exploitation. Now, why are the other options incorrect? Option B is incorrect. OpenVAS scans hosts and network services, not cloud control plane settings. Option C is incorrect. Nikto tests web servers for known problems and misconfigurations. Option D is incorrect. Metasploit is an exploitation framework, not a configuration assessment tool. Therefore, A, ScoutSuite, is the correct answer.
Play from 06:29 Question 5. A help desk escalates an alert: an employee opened a phishing link built to steal passwords. The analyst confirms the page is malicious and that the employee loaded it, finds no sign the stolen password was used, suggests refresher training and closes the ticket. Which response step was skipped? Here are the options. Option A. Recovery. Option B. Post-incident review. Option C. Analysis. Option D. Containment. Pause the video now if you want time to think about the answer.
The correct answer is D. Containment. The analyst proved the link was built to harvest passwords and that the employee loaded it, yet closed the ticket without acting on the account. Containment limits harm while that is still possible, for example by resetting the password and ending active sessions. Closing the case because no misuse was seen leaves the exposed credential live. Now, why are the other options incorrect? Option A is incorrect. Nothing was taken out of service, so there is nothing to restore. Option B is incorrect. The review comes after a response is finished, so it is not what was missed. Option C is incorrect. The analyst did examine the link and confirm the visit, so analysis took place. Therefore, D, Containment, is the correct answer.
Play from 08:05 Question 6. A SOC team asks a generative AI assistant to link related alerts. Several of the links it reports involve events that never took place, so the correlations are wrong. What is this behavior called? Here are the options. Option A. Malicious prompts. Option B. Hallucinations. Option C. Data exposure. Option D. Model poisoning. Pause the video now if you want time to think about the answer.
The correct answer is B. Hallucinations. A hallucination happens when a model produces confident, believable output that has no basis in what it was given, such as invented events. The fabrication comes from the model's own generation, not from tampered training data or a hostile instruction. Now, why are the other options incorrect? Option A is incorrect. That would need an attacker to craft input aimed at steering the model, and nobody did that here. Option C is incorrect. Exposure means information leaking out, not information being made up. Option D is incorrect. Poisoning is a deliberate corruption of training data, which is an attack and not this fault. Therefore, B, Hallucinations, is the correct answer.
Play from 09:38 Question 7. After rewriting the incident response plan, a security lead wants executives, legal staff and technical teams to talk through the changes together. What is the best way to test them? Here are the options. Option A. Penetration test. Option B. Security awareness training. Option C. Tabletop exercise. Option D. Red-teaming event. Pause the video now if you want time to think about the answer.
The correct answer is C. Tabletop exercise. In a tabletop exercise the participants walk through an invented incident and discuss who decides what. That reveals gaps in roles, decisions and communication, and since it is discussion based, senior and non-technical people can join easily. Now, why are the other options incorrect? Option A is incorrect. A penetration test probes systems for technical flaws, not the decision paths in the plan. Option B is incorrect. Awareness training teaches staff in general terms and does not exercise the plan. Option D is incorrect. A red team attacks to test technical detection and response, rather than letting stakeholders talk through the plan. Therefore, C, Tabletop exercise, is the correct answer.
Play from 11:14 Question 8. An enterprise wants a network design with no fixed perimeter, enforcing security wherever its users connect from. Which architecture fits best? Here are the options. Option A. SASE, with networking and security delivered from the cloud edge. Option B. Content delivery networks. Option C. Hybrid cloud networks. Option D. Cloud-native computing. Pause the video now if you want time to think about the answer.
The correct answer is A. SASE, with networking and security delivered from the cloud edge. SASE delivers security controls from a distributed cloud service and applies them to each user and session wherever they are. Access stops depending on sitting inside a network boundary, so the design has no perimeter. Now, why are the other options incorrect? Option B is incorrect. Content delivery networks place content near users for speed and do not enforce access. Option C is incorrect. A hybrid cloud still ties environments together across defined boundaries. Option D is incorrect. Cloud-native describes how applications are built and deployed, not how access is secured. Therefore, A, SASE, with networking and security delivered from the cloud edge, is the correct answer.
Play from 12:55 Question 9. After a supplier discloses a fresh vulnerability, an analyst's recurring scans come back empty. The weakness is only caught once a host's settings are altered. Which scan type had the analyst set up? Here are the options. Option A. Credentialed. Option B. Network. Option C. External. Option D. Agent-based. Pause the video now if you want time to think about the answer.
The correct answer is D. Agent-based. An agent sits on the host and checks it against current vulnerability data all the time, so a change in settings is noticed right away. Scans that run on a timetable would have found nothing at their last run, which matches what the analyst saw. Now, why are the other options incorrect? Option A is incorrect. A credentialed scan looks deeper but still runs only on its schedule. Option B is incorrect. A network scan looks at services over the wire and also follows the schedule. Option C is incorrect. An external scan checks internet-facing exposure and would not see an internal setting change. Therefore, D, Agent-based, is the correct answer.
Play from 14:21 Question 10. Two weeks into a major breach, a company has cleaned malware from only some of the affected systems, and many internal services are still down. Which response phase is the team in? Here are the options. Option A. Post-incident. Option B. Preparation. Option C. Detection. Option D. Eradication. Option E. Analysis. Pause the video now if you want time to think about the answer.
The correct answer is D. Eradication. Services are still down and malware remains on some systems, so removing the attacker is not finished. That is the eradication phase, which lasts until every affected host is clean, however long that takes. Now, why are the other options incorrect? Option A is incorrect. The review happens only after the response is complete. Option B is incorrect. Preparation is done before any incident occurs. Option C is incorrect. The incident was identified two weeks ago, so detection is behind them. Option E is incorrect. The team already knows what happened and is now acting on it. Therefore, D, Eradication, is the correct answer.
Play from 15:47 Question 11. A threat analyst explains to a new hire why defenders should study adversary tactics, techniques, and procedures. What is the strongest reason? Here are the options. Option A. They expose the file hashes and network addresses tied to an attacker. Option B. They reveal how an attacker plans and behaves. Option C. They list the specific tools an attacker uses. Option D. They capture the attacker's indicators of compromise. Pause the video now if you want time to think about the answer.
The correct answer is B. They reveal how an attacker plans and behaves. TTPs describe how an adversary works, not just what traces were left behind. Addresses and file hashes change as soon as infrastructure is rebuilt, whereas the underlying behavior is expensive to alter and recurs from one campaign to the next. Defending against behavior therefore still works after indicators have changed. Now, why are the other options incorrect? Option A is incorrect. Hashes and addresses are the cheapest things for an attacker to swap out. Option C is incorrect. Tools can be exchanged for similar ones without altering how the adversary works. Option D is incorrect. Indicators are leftovers from an attack, not the behavior that produced it. Therefore, B, They reveal how an attacker plans and behaves, is the correct answer.
Play from 17:26 Question 12. A company's CIO orders staff to stop using an unsupported legacy system that no longer gets security patches, since it is being retired. Which risk strategy is that? Here are the options. Option A. Transference. Option B. Acceptance. Option C. Avoidance. Option D. Mitigation. Pause the video now if you want time to think about the answer.
The correct answer is C. Avoidance. When the system is removed, the activity that created the risk is gone, which is exactly what avoidance means. With the system retired, no leftover exposure has to be managed. Now, why are the other options incorrect? Option A is incorrect. Transference moves the loss to someone else, for example through insurance. Option B is incorrect. Acceptance would mean keeping the system running and living with the exposure. Option D is incorrect. Mitigation lowers the likelihood or impact but leaves the system in use. Therefore, C, Avoidance, is the correct answer.
Play from 18:45 Question 13. A company runs a simulated phishing test, and the security team looks at the percentage of recipients who clicked the link. What does that figure indicate? Here are the options. Option A. How aware staff are of security risks. Option B. How many alerts the data loss prevention tool raised falsely. Option C. How quickly the team reacted to the social engineering attempt. Option D. How well the email filters caught the lure. Pause the video now if you want time to think about the answer.
The correct answer is A. How aware staff are of security risks. A simulated phish tests whether people spot and resist a lure, and the click rate shows the share who did not. It therefore gauges employee awareness and points to who needs extra training. Now, why are the other options incorrect? Option B is incorrect. False positives in a data loss tool are a tuning metric for a different control. Option C is incorrect. Reaction speed is measured by time to report or respond, not by clicks. Option D is incorrect. Filter performance shows in what the gateway blocked, not in what recipients did. Therefore, A, How aware staff are of security risks, is the correct answer.
Play from 20:17 Question 14. A new analyst joins a security improvement project and begins a standing weekly call with the engineers to learn how they work and what skills they bring. What is the call mainly for? Here are the options. Option A. Coordinating the team's work. Option B. Delivering incident response training. Option C. Setting up vendor briefings. Option D. Answering customer requirements. Pause the video now if you want time to think about the answer.
The correct answer is A. Coordinating the team's work. A recurring call with the people doing the work is a coordination tool. It lets the analyst see how tasks flow and what skills exist, and keeps everyone aligned as the project proceeds, so the purpose is coordination rather than training or gathering requirements. Now, why are the other options incorrect? Option B is incorrect. Training follows a set curriculum and would not reveal how the team works. Option C is incorrect. Vendor briefings involve outside suppliers who are not on the task force. Option D is incorrect. Customer requirements are external work handled elsewhere. Therefore, A, Coordinating the team's work, is the correct answer.
Play from 21:48 Question 15. What term describes the risk that is still present once safeguards have been put in place? Here are the options. Option A. Inherent. Option B. Appropriate. Option C. Residual. Option D. Acceptable. Pause the video now if you want time to think about the answer.
The correct answer is C. Residual. Residual risk is what remains after controls are in place, since no safeguard brings exposure to zero. The organization has to accept, watch, or further treat that remainder. Now, why are the other options incorrect? Option A is incorrect. Inherent risk is the level before any safeguards are applied. Option B is incorrect. Appropriate is not a recognized category of risk. Option D is incorrect. Acceptable risk is the tolerated threshold, not the measured leftover. Therefore, C, Residual, is the correct answer.
Play from 22:58 Question 16. A SOC manager is deciding whether a provider broke its contract. The agreement under review was signed by the finance chief, a sales director and the client, and it contains measurable performance targets. Which document is it? Here are the options. Option A. Memorandum of understanding. Option B. Financial payback analysis. Option C. Risk management plan. Option D. A catalog of adversary behaviors. Option E. Service-level agreement. Pause the video now if you want time to think about the answer.
The correct answer is E. Service-level agreement. A service-level agreement is the contract between a provider and a customer that fixes the promised service and the performance indicators used to measure it. Breach is judged against those targets, and signatures from both sides fit this document. Now, why are the other options incorrect? Option A is incorrect. A memorandum of understanding records shared intent and normally is not binding or tied to measurable targets. Option B is incorrect. A payback analysis justifies spending inside the company. Option C is incorrect. A risk plan describes how risk is handled and does not commit to service levels. Option D is incorrect. A catalog of adversary behaviors describes attackers and is not a contract. Therefore, E, Service-level agreement, is the correct answer.
Play from 24:43 Question 17. Once an incident has been closed, which report gives the fullest account of it? Here are the options. Option A. Root cause analysis. Option B. After action. Option C. Situation report. Option D. Lessons-learned. Pause the video now if you want time to think about the answer.
The correct answer is B. After action. An after action report is the full record created when an incident ends. It gathers the timeline, cause, response steps, impact and lessons into one document, so it is broader than any single review output. Now, why are the other options incorrect? Option A is incorrect. Root cause analysis explains why it happened and forms one section of the larger report. Option C is incorrect. A situation report is a progress update issued while the incident is still going. Option D is incorrect. Lessons learned lists improvements and is just one part of the full report. Therefore, B, After action, is the correct answer.
Play from 26:02 Question 18. A SOC analyst reads a packet capture file with tshark and sets the display filter to "http or udp". What will the output show? Here are the options. Option A. Web requests sent over TLS plus DNS traffic. Option B. Both TLS-protected and clear web traffic plus DNS traffic. Option C. Clear-text web requests plus DNS traffic. Option D. None of the web or DNS traffic. Pause the video now if you want time to think about the answer.
The correct answer is C. Clear-text web requests plus DNS traffic. The filter keeps frames dissected as HTTP plus every UDP packet. HTTP is unencrypted web traffic, and DNS normally travels over UDP, so the result is clear web requests along with DNS. HTTPS rides on TLS over TCP, so it satisfies neither condition. Now, why are the other options incorrect? Option A is incorrect. TLS-protected requests are identified as TLS, not HTTP, so the filter leaves them out. Option B is incorrect. Since encrypted web traffic is not matched, the output cannot contain both kinds. Option D is incorrect. The filter matches plenty of packets; it does not exclude everything. Therefore, C, Clear-text web requests plus DNS traffic, is the correct answer.
Play from 27:46 Question 19. A vulnerability team is trying to close out a finding. Which type of system is most likely to block remediation? Here are the options. Option A. Closed systems. Option B. Controlled systems. Option C. Shared systems. Option D. Legacy systems. Pause the video now if you want time to think about the answer.
The correct answer is D. Legacy systems. Legacy systems often have no fix to apply: the vendor has dropped support, no patch will come, and the platform may not accept one anyway. The organization is left with workarounds in place of remediation, which is exactly what blocks it. Now, why are the other options incorrect? Option A is incorrect. A closed system limits access, but its operator can still apply patches. Option B is incorrect. Controlled systems sit behind change management, which slows fixes but does not stop them. Option C is incorrect. Shared systems make scheduling harder because many owners must agree, but a fix still exists. Therefore, D, Legacy systems, is the correct answer.
Play from 29:09 Question 20. An analyst keeps receiving a SIEM notification that turns out to be wrong. What should the analyst use to address it? Here are the options. Option A. Dashboard creation. Option B. Alert tuning. Option C. Data enrichment. Option D. Threat hunting. Pause the video now if you want time to think about the answer.
The correct answer is B. Alert tuning. A notification that does not match reality points to a detection rule that needs adjusting. Alert tuning refines the logic and thresholds so the rule stops misfiring, which solves the cause instead of handling its output again and again. Now, why are the other options incorrect? Option A is incorrect. A dashboard changes how results look, not whether the rule is accurate. Option C is incorrect. Enrichment adds context to an alert, but a wrong alert with context is still wrong. Option D is incorrect. Hunting looks proactively for undetected activity and does not repair a faulty rule. Therefore, B, Alert tuning, is the correct answer.
Play from 30:32 Question 21. When would an organization most likely rely on compensating controls? Here are the options. Option A. A flaw has been fixed, tested and rolled out to production. Option B. A flaw was flagged, but review shows it is a false positive. Option C. A flaw has no patch available and the affected system is critical to the business. Option D. A flaw is under active attack elsewhere, but the company does not run the affected product. Pause the video now if you want time to think about the answer.
The correct answer is C. A flaw has no patch available and the affected system is critical to the business. A compensating control stands in when the preferred control cannot be applied. That happens when a flaw cannot be patched and the system is too important to turn off, so the organization lowers exposure through other means. Now, why are the other options incorrect? Option A is incorrect. A fully fixed and deployed flaw needs no substitute control. Option B is incorrect. A confirmed false positive carries no actual risk to offset. Option D is incorrect. A company that does not use the product has no exposure to compensate for. Therefore, C, A flaw has no patch available and the affected system is critical to the business, is the correct answer.
Play from 32:17 Question 22. An incident response team is investigating a suspected data leak and gathering evidence from many IT systems. Which process makes sure each evidence item is properly documented? Here are the options. Option A. Storage and containment. Option B. Packaging and labeling. Option C. Post-incident reporting. Option D. Chain of custody. Pause the video now if you want time to think about the answer.
The correct answer is D. Chain of custody. Chain of custody is a written log of who handled each piece of evidence, when and why, kept unbroken from the point of collection. That log is what lets the evidence stand up later. Now, why are the other options incorrect? Option A is incorrect. Storage and containment keeps evidence safe but does not record who handled it. Option B is incorrect. Packaging and labeling is one physical step within the larger custody process. Option C is incorrect. Post-incident reporting summarizes the event afterward. Therefore, D, Chain of custody, is the correct answer.
Play from 33:42 Question 23. An analyst is handling a cloud identity alert. An attacker holding a hijacked user role is trying to reach a different isolated cloud subscription. Which ATT&CK tactic does this describe? Here are the options. Option A. Execution. Option B. Credential access. Option C. Lateral movement. Option D. Privilege escalation. Option E. Persistence. Pause the video now if you want time to think about the answer.
The correct answer is C. Lateral movement. The attacker already controls a role and is using it to reach another environment. Moving between systems or environments with access already gained is lateral movement; the goal is wider reach, not more rights in the same place. Now, why are the other options incorrect? Option A is incorrect. Execution means running code on a target. Option B is incorrect. Credential access is stealing credentials, which has already happened here. Option D is incorrect. Privilege escalation means gaining higher permissions, not using current access to go elsewhere. Option E is incorrect. Persistence is about keeping access across restarts and credential changes. Therefore, C, Lateral movement, is the correct answer.
Play from 35:10 Question 24. An analyst has a plain text report about an APT campaign and needs to pull every IPv4 address out of it. Which tool suits this best? Here are the options. Option A. OpenCTI, a threat intelligence platform. Option B. CyberChef. Option C. Wireshark. Option D. Zeek. Pause the video now if you want time to think about the answer.
The correct answer is B. CyberChef. CyberChef transforms and extracts data from unstructured text using chained operations, including a recipe that finds IPv4 addresses in any content. The source is a document rather than captured traffic, so an extraction tool is the right instrument. Now, why are the other options incorrect? Option A is incorrect. OpenCTI stores and links threat data that is already structured and is not meant for extracting from raw text. Option C is incorrect. Wireshark analyzes packet captures and cannot parse a text report. Option D is incorrect. Zeek produces logs from network traffic, not from written documents. Therefore, B, CyberChef, is the correct answer.
Play from 36:35 Question 25. A security analyst asks management to pay for a subscription to an industry-specific threat intelligence feed. How is this kind of feed best classified? Here are the options. Option A. Open-source intelligence. Option B. Threat modeling. Option C. Closed-source intelligence. Option D. Threat mapping. Pause the video now if you want time to think about the answer.
The correct answer is C. Closed-source intelligence. Closed-source intelligence is created and sold by a vendor to paying customers, with restricted distribution. The paid relationship and limited access describe a subscription feed tailored to an industry. Now, why are the other options incorrect? Option A is incorrect. Open-source intelligence comes from public material at no charge. Option B is incorrect. Threat modeling is a design-time analysis method, not a feed. Option D is incorrect. Threat mapping relates threats to assets or techniques and is an activity rather than a feed type. Therefore, C, Closed-source intelligence, is the correct answer.
Play from 37:56 Question 26. During an incident, where would a responder find the contact details of the people who must be informed? Here are the options. Option A. The corporate org chart. Option B. The report from the previous incident. Option C. Step-by-step operating procedure documents. Option D. The incident response communication plan. Pause the video now if you want time to think about the answer.
The correct answer is D. The incident response communication plan. The communication plan is the part of the response plan that lists who has to be told, in what order, over which channel, and how to reach them. Having that ready beforehand matters, because mid-incident is the worst moment to hunt for phone numbers. Now, why are the other options incorrect? Option A is incorrect. An org chart shows reporting lines, not incident roles or ways to reach people. Option B is incorrect. A past report describes an earlier event and is not kept as a contact directory. Option C is incorrect. Standard operating procedures explain how tasks are done, not who must be notified. Therefore, D, The incident response communication plan, is the correct answer.
Play from 39:28 Question 27. In which phase of incident response is an attacker's access to company resources removed for good? Here are the options. Option A. Detection. Option B. Eradication. Option C. Denial of service. Option D. Containment. Pause the video now if you want time to think about the answer.
The correct answer is B. Eradication. Eradication removes the attacker and everything left behind, such as rogue accounts, implants, scheduled tasks and altered binaries. Containment merely limits reach while the intruder is still present, whereas eradication ends the access for good. Now, why are the other options incorrect? Option A is incorrect. Detection only identifies that an intrusion is happening. Option C is incorrect. Denial of service is a type of attack, not a response phase. Option D is incorrect. Containment restricts what the attacker can reach without removing them. Therefore, B, Eradication, is the correct answer.
Play from 40:53 Question 28. After an incident is resolved, what is normally used to find efficiencies and corrective actions in how the response was handled? Here are the options. Option A. Performance measures such as KPIs. Option B. Lessons learned. Option C. Executive summary. Option D. Root cause analysis. Pause the video now if you want time to think about the answer.
The correct answer is B. Lessons learned. The review held after closure asks what worked, what failed and what should change in future. Its product is a set of improvements to the way the team responds. Now, why are the other options incorrect? Option A is incorrect. Performance measures show how the response did but not what to change. Option C is incorrect. An executive summary condenses the incident for leadership. Option D is incorrect. Root cause analysis explains why the incident happened, not how the response could improve. Therefore, B, Lessons learned, is the correct answer.
Play from 42:12 Question 29. A security architect is helping a client build SOC capabilities and wants log correlation and investigations to be accurate across all systems. What should the client implement? Here are the options. Option A. SASE. Option B. Account federation. Option C. ZTNA. Option D. Time synchronization with NTP. Option E. APIs. Pause the video now if you want time to think about the answer.
The correct answer is D. Time synchronization with NTP. Correlating events across many systems only works if their timestamps mean the same thing. With unsynchronized clocks, records from different hosts cannot be ordered reliably and investigators can misjudge cause and sequence, so NTP underpins accurate correlation. Now, why are the other options incorrect? Option A is incorrect. SASE delivers network security from the cloud and says nothing about timestamps. Option B is incorrect. Account federation unifies identity across systems, not time. Option C is incorrect. ZTNA governs how access is granted. Option E is incorrect. APIs move data between tools but do not make its timestamps comparable. Therefore, D, Time synchronization with NTP, is the correct answer.
Play from 43:55 Question 30. Why should confidential data on employee laptops be encrypted while stored on the drive? Here are the options. Option A. To meet regulations and legal obligations. Option B. To stop users from copying files to other systems. Option C. To keep the data confidential if a device is stolen. Option D. To guarantee data integrity across the corporate network. Pause the video now if you want time to think about the answer.
The correct answer is C. To keep the data confidential if a device is stolen. Disk encryption protects data once a device leaves its owner's hands. A thief with a laptop has unlimited physical access and could remove the drive to read it, but encrypted contents stay unreadable. Preventing disclosure after theft is the aim of encryption at rest. Now, why are the other options incorrect? Option A is incorrect. Compliance often follows from encrypting, but the security purpose is protection against disclosure. Option B is incorrect. A signed-in user with the drive unlocked can still copy files, so encryption does not prevent it. Option D is incorrect. Encryption provides confidentiality, and integrity relies on other mechanisms. Therefore, C, To keep the data confidential if a device is stolen, is the correct answer.
