Free CompTIA CySA+ Practice Exam (2026)

Your score by topic

Get a free CySA+ study plan on WhatsApp See CompTIA CySA+ Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Vulnerability Management⚑ Flag

Ashford Group just acquired a regional company and connected its network to the corporate WAN. No accurate inventory exists for the new sites. Before scheduling vulnerability scans, what should the analyst do FIRST?

ARun a discovery scan to identify live hosts and services across the new address ranges BRequest a penetration test of the new sites to find the most critical exploitable systems CApply the corporate patch baseline to all new systems before any scanning takes place DLaunch a full credentialed scan using the domain administrator account from headquarters

Correct answer: A. Run a discovery scan to identify live hosts and services across the new address ranges
Discovery builds the asset inventory that defines scan scope, credentials and schedules, so it comes first. A full credentialed scan cannot be planned well when the team does not know which hosts exist or what operating systems they run.

Question 2Incident Response⚑ Flag

Fairhaven Credit's email security gateway detonated an attachment in a sandbox, found that it launched a malicious script, and quarantined the message before it reached any inboxes. At which Cyber Kill Chain stage did the defenses break the attack?

AWeaponization BExploitation CDelivery DReconnaissance

Correct answer: C. Delivery
Delivery is the transmission of the weaponized payload to the target, and the gateway stopped the message during that transmission. Weaponization happened earlier on the attacker's side when the malicious file was built, so defenders cannot directly block it.

Question 3Security Operations⚑ Flag

A network engineer at Delmont Credit Union set all core switches to debug-level logging while troubleshooting and never changed them back. SIEM licensing costs have tripled and analysts struggle to find meaningful events. What is the BEST corrective action?

ABuy additional SIEM license capacity to absorb the new log volume BFilter all switch logs out of the SIEM and keep them on the devices CCut SIEM retention for switch logs from one year down to one week DRestore a standard logging level and use debug only when needed

Correct answer: D. Restore a standard logging level and use debug only when needed
Debug level produces very high volumes of low-value messages and should be enabled only temporarily for troubleshooting. Restoring a normal level cuts cost and noise while keeping useful events. Removing switch logs from the SIEM would also cut cost, but it would blind analysts to legitimate network security events.

Question 4Security Operations⚑ Flag

On Monday morning, Elmhurst College's edge router shows outbound traffic jump from about 300 Mbps to 2.4 Gbps. The top talkers are 18 computer lab PCs, each sending a constant stream of small UDP packets with random payloads to the same external IP address. What is the MOST likely explanation?

AA switching loop is causing a broadcast storm in the lab BStudents are streaming video during a morning lecture CThe lab PCs are pulling a large operating system update DThe lab PCs are bots taking part in a DDoS attack

Correct answer: D. The lab PCs are bots taking part in a DDoS attack
Many hosts suddenly sending sustained, high-rate streams of small, random UDP packets to one outside target matches botnet participation in a denial-of-service attack. An operating system update or video streaming would mostly raise inbound download traffic, not outbound floods aimed at a single address.

Question 5Reporting & Communication⚑ Flag

Galloway Payments is preparing for its annual PCI DSS assessment, and the assessor asks for vulnerability management documentation. Which report BEST meets the assessor's needs?

AAn email summary from the CISO stating that all systems are patched BScan results mapped to each PCI requirement, with dates and rescans CA one-page dashboard showing the overall risk score trending downward DA top 10 list of vulnerabilities ranked by number of affected hosts

Correct answer: B. Scan results mapped to each PCI requirement, with dates and rescans
Auditors and assessors need evidence tied to specific control requirements, such as dated quarterly scans and passing rescans. A risk score dashboard is useful for executives but does not prove that each requirement was met.

Question 6Vulnerability Management⚑ Flag

Dovetail Hotels placed its only vulnerability scanner in the corporate user VLAN. Scans of the payment card segment return no live hosts, even though dozens of payment terminals and servers are known to be there. The segment is protected by strict firewall rules. What is the BEST way to get accurate results?

AMark the payment segment as fully remediated, since the scan found nothing to report there BPlace a scanner inside the payment segment or permit only the scanner through the firewall CIncrease the scan timeout values so probes have more time to pass through the firewall rules DRemove the firewall rules between the user VLAN and the payment segment during each scan

Correct answer: B. Place a scanner inside the payment segment or permit only the scanner through the firewall
Network segmentation correctly blocks most traffic, so the scanner needs a presence in the segment or a narrowly scoped rule that permits only its traffic. Removing firewall rules for scans would weaken the very segmentation that protects cardholder data.

Question 7Incident Response⚑ Flag

An analyst at Summit Ridge Energy is documenting an intrusion with the Diamond Model. She has recorded the attacker's persona, the targeted SCADA engineers and the staging servers used. She now needs to record the custom loader and the exploit for an unpatched VPN flaw. Which core feature do these belong to?

AInfrastructure BAdversary CMethodology DCapability

Correct answer: D. Capability
In the Diamond Model, capability covers the tools and techniques the adversary uses, such as malware and exploits. Infrastructure is the set of systems used to deliver or control those capabilities, like the staging servers she already recorded.

Question 8Security Operations⚑ Flag

During an investigation on a Windows 10 workstation at Kessler Architects, the analyst learns the attacker's tool has already been deleted. The analyst wants evidence showing that the executable ran, how many times it ran and when it last ran. Which location is MOST likely to provide this?

AC:\Windows\System32\drivers\etc BC:\Windows\Temp CC:\Windows\Prefetch DC:\ProgramData\Microsoft\Windows\Start Menu

Correct answer: C. C:\Windows\Prefetch
Prefetch files on Windows workstations record an executable's name, run count and recent run times, and they remain after the program itself is deleted. The drivers\etc folder holds the hosts file and similar network configuration, not execution history.

Question 9Security Operations⚑ Flag

A network access control report at Juniper Ridge Schools flags a device plugged into a wall jack in a library study room. Its MAC address prefix belongs to a maker of single-board computers, it is not in the asset inventory, and the port's 802.1X enforcement is in monitor-only mode. The device is sending ARP requests across the staff VLAN. What is the BEST next step?

AAdd the device's MAC address to the approved list BDisable the switch port and locate the device CGive the device a static IP so it is easier to track DIgnore it, because ARP requests are normal traffic

Correct answer: B. Disable the switch port and locate the device
An unknown, unmanaged device on an internal network is a rogue device, and a small single-board computer in a public area could be a covert implant probing the network. Disabling the port contains it while staff find and examine it, whereas approving its MAC address would legitimize a device nobody can account for.

Question 10Reporting & Communication⚑ Flag

The vulnerability program manager at Quarry Hill University wants to show whether a new automated patching tool has reduced risk over the past four quarters. Which report type BEST supports this goal?

AA top 10 list of the most common findings in the latest scan BAn asset inventory report listing every host scanned last week CA trend report of open critical and high findings per quarter DA point-in-time report from the most recent scan cycle only

Correct answer: C. A trend report of open critical and high findings per quarter
Trend reporting compares the same measures across time, which shows whether the program improved after a change. A point-in-time report only shows the current state and cannot show direction.

Question 11Vulnerability Management⚑ Flag

A widely reported remote code execution flaw was published 10 days ago. Ellery Insurance's scan last night found no instances, but a manual check confirmed several vulnerable servers. The analyst notices the scanner's plugin feed was last updated three weeks ago. What should the analyst do?

AUpdate the scanner's plugin feed or signatures, confirm the new checks loaded, and rescan BSwitch from credentialed to non-credentialed scanning so the scanner covers more hosts CReport the manual findings as false positives because the scanner did not confirm them DLower the scan's severity threshold so that it reports informational findings as well

Correct answer: A. Update the scanner's plugin feed or signatures, confirm the new checks loaded, and rescan
A scanner can only detect vulnerabilities its checks know about, so an outdated feed produces false negatives for newly published flaws. The manual results are confirmed, so labeling them false positives would leave real vulnerabilities untracked.

Question 12Incident Response⚑ Flag

Logs at Ashford Medical Group show that an attacker used a stolen help desk account to open RDP sessions from a compromised workstation to four internal file servers. Which MITRE ATT&CK tactic BEST describes this activity?

APrivilege Escalation BLateral Movement CInitial Access DDiscovery

Correct answer: B. Lateral Movement
Using remote services such as RDP to move from one internal system to others is the Lateral Movement tactic. The stolen account is not being used to gain higher permissions on a single host, so Privilege Escalation does not fit what the logs show.

Question 13Vulnerability Management⚑ Flag

Calloway Consulting wants an independent auditor to certify its information security management system, including how it manages technical vulnerabilities. Which standard defines the requirements the company will be certified against?

AISO/IEC 27001 BISO/IEC 27005 CISO/IEC 27017 DISO/IEC 27002

Correct answer: A. ISO/IEC 27001
ISO/IEC 27001 sets the requirements for an information security management system and is the standard organizations are certified against, with Annex A listing controls such as management of technical vulnerabilities. ISO/IEC 27002 gives guidance on implementing those controls but is not a certification standard.

Question 14Security Operations⚑ Flag

Which statement BEST describes a key security difference between containers and virtual machines?

AContainers cannot be scanned for vulnerabilities until after they are deployed BContainers always include a full guest OS, so they need more patching than VMs CContainers share the host operating system kernel, while VMs each run their own DVMs share the host kernel, so a single kernel exploit affects every VM on a host

Correct answer: C. Containers share the host operating system kernel, while VMs each run their own
Containers isolate processes but share the host kernel, so a kernel flaw or a privileged container can expose the host and its other containers. Virtual machines run separate guest kernels on a hypervisor, which gives stronger isolation, so the claim that VMs share the host kernel is reversed.

Question 15Incident Response⚑ Flag

Crescent Harbor Port Authority wants a security testing methodology that covers people, physical sites, wireless signals, telecommunications and data networks. Leadership also wants results expressed as measurable operational security metrics. Which methodology BEST meets these needs?

AMITRE ATT&CK BCyber Kill Chain COWASP Web Security Testing Guide DOSSTMM

Correct answer: D. OSSTMM
OSSTMM is a peer-reviewed methodology that tests operational security across human, physical, wireless, telecommunications and data network channels and produces quantified results. The OWASP guide is limited to web application testing, so it cannot cover physical or human channels.

Question 16Security Operations⚑ Flag

A Zeek log at Meridian Shipping shows a DMZ server holding a long-lived session to an external host on TCP 443. No TLS handshake appears in the session, and Zeek's protocol detection labels the traffic as SSH. What is the MOST likely explanation?

AA TLS session that the corporate proxy already decrypted BA DNS zone transfer running over a nonstandard port CA normal HTTPS session that relies on an older cipher suite DSSH traffic disguised on a port normally used for HTTPS

Correct answer: D. SSH traffic disguised on a port normally used for HTTPS
Port 443 is expected to carry TLS, so a session with no handshake that is identified as SSH means SSH is running on a port chosen to blend in with web traffic. An older cipher suite would still produce a TLS handshake, which is exactly what the log shows is missing.

Question 17Reporting & Communication⚑ Flag

The board at Meridale Credit Union asks whether IT is meeting its policy of fixing critical vulnerabilities within 15 days. The security team tracks every finding's open and close dates. Which metric answers the board's question MOST directly?

APercentage of critical findings closed within 15 days BTotal number of open vulnerabilities this month CAverage CVSS score of all open findings DNumber of scans completed this quarter

Correct answer: A. Percentage of critical findings closed within 15 days
SLA compliance rate shows exactly how often critical findings are fixed within the promised window. A raw count of open findings changes with scan scope and asset growth, so it does not say whether the 15-day target is being met.

Question 18Vulnerability Management⚑ Flag

An external Nmap scan of Brookfield Dental's public IP range shows 445/tcp open on a file server. The server is meant to share files only with staff at the main office. What should the analyst recommend FIRST?

ARename the file shares so that their purpose is less obvious to outsiders BBlock SMB traffic from the internet at the perimeter firewall CChange the SMB service so that it listens on a nonstandard port DEnable verbose SMB logging so suspicious connections are recorded

Correct answer: B. Block SMB traffic from the internet at the perimeter firewall
SMB should not be exposed to the internet, and blocking it at the perimeter removes the exposure immediately. Moving the service to another port is security through obscurity, since scanners can still find and identify it.

Question 19Incident Response⚑ Flag

EDR at Thornfield Robotics flags PowerShell launching encoded commands, but scans find no malicious files on disk. Analysts suspect the payload runs only inside a legitimate process. Which evidence source is MOST likely to contain the malicious code?

AThe Windows prefetch folder on the host BA forensic image of the system drive CFirewall logs from the network perimeter DA memory capture of the running system

Correct answer: D. A memory capture of the running system
Fileless malware lives in memory, often injected into legitimate processes, so a memory capture can reveal the injected code, decoded scripts and active connections. A disk image would likely miss it, because the payload was never written to the file system.

Question 20Security Operations⚑ Flag

Ransomware at Pellham County Hospital spread from one infected file server to 60 other servers in the same flat data center network within an hour. The architecture team wants to limit east-west movement between workloads, even those on the same subnet. Which approach BEST achieves this?

AA dedicated VLAN for all servers in the data center BAn intrusion detection sensor on the internet uplink CMicrosegmentation with workload-level policies DA stronger perimeter firewall at the internet edge

Correct answer: C. Microsegmentation with workload-level policies
Microsegmentation applies granular policies to individual workloads, so traffic between servers is blocked unless explicitly allowed, even within one subnet. Putting all servers into one VLAN still leaves them free to talk to each other, which is how the ransomware spread.

Question 21Security Operations⚑ Flag

EDR at Calloway Pharmacy flags this process chain on a pharmacist's PC: OUTLOOK.EXE > WINWORD.EXE > powershell.exe -nop -w hidden -enc SQBFAFgA... What makes this chain MOST suspicious?

AWord launched hidden PowerShell with an encoded command BPowerShell should only ever run on domain controllers CThe command relies on an outdated .NET runtime version DOutlook launched Word, which never happens in normal use

Correct answer: A. Word launched hidden PowerShell with an encoded command
Office applications rarely need to start PowerShell, and the -nop, -w hidden and -enc flags skip profiles, hide the window and obscure the command, a pattern common in malicious macros. Outlook opening Word is normal when a user opens an attachment, so that link alone is not the concern.

Question 22Vulnerability Management⚑ Flag

While testing Quillon Mortgage's customer portal with Burp Suite, an analyst changes the loanId value in an intercepted request from 10482 to 10483. The server returns another customer's loan documents. Which fix BEST addresses this weakness?

AEncode the loanId value in Base64 so that users cannot easily read or change the number BAdd input validation that confirms the loanId parameter contains only numeric digits CCheck on the server that the logged-in user is authorized to view each requested record DMove the loanId from the URL query string into a hidden field inside the request body

Correct answer: C. Check on the server that the logged-in user is authorized to view each requested record
This is broken access control, specifically an insecure direct object reference, and the fix is to verify on the server that the session's user is authorized for every object requested. Encoding or hiding the identifier only obscures it, and a tester can still decode or modify it.

Question 23Reporting & Communication⚑ Flag

An audit at Whitcomb County found 40 high-risk vulnerabilities that cannot all be fixed before the next audit cycle because of staffing limits. The auditor asks how the county will track progress on closing them. What should the security team produce?

AA plan of action and milestones with owners and dates BA formal request to defer the findings to the next audit CA revised scan policy that excludes the affected systems DA single risk acceptance memo covering all 40 findings

Correct answer: A. A plan of action and milestones with owners and dates
A plan of action and milestones lists each weakness, the responsible owner, the planned steps, and target dates, so progress can be measured. Accepting the risk on every finding avoids the work and is not appropriate for high-risk items the county intends to fix.

Question 24Incident Response⚑ Flag

Halvorsen Retail's legal team expects a lawsuit from a customer whose data was exposed in a recent breach. The retention policy automatically deletes email and VPN logs after 30 days, and some relevant records are already 25 days old. What should happen FIRST?

AWait for the lawsuit to be filed before changing any retention settings BIssue a legal hold that suspends deletion of the relevant records CAsk each employee to keep any emails they think are relevant to the case DPrint the relevant logs and store the paper copies in a locked cabinet

Correct answer: B. Issue a legal hold that suspends deletion of the relevant records
A legal hold suspends normal retention and deletion for records that may be relevant once litigation is reasonably expected. Waiting for the lawsuit to be filed would let the automatic policy destroy evidence, which can lead to spoliation penalties.

Question 25Vulnerability Management⚑ Flag

A Scout Suite report for Halvorsen Robotics flags a cloud security group that allows inbound SSH on port 22 from 0.0.0.0/0. The group is attached to a bastion host used by six administrators who work from two office locations. Which recommendation BEST reduces the exposure?

ALimit the rule to the offices' public IP ranges or use a managed session access service BKeep the rule but move SSH to port 2222 so that automated scanners are less likely to find it CDelete the bastion host and give administrators direct SSH access to each internal server DAdd a matching rule that allows SSH from anywhere on IPv6 so admin access stays consistent

Correct answer: A. Limit the rule to the offices' public IP ranges or use a managed session access service
Limiting the source to known office ranges, or using a managed session service, removes the internet-wide exposure while preserving administrator access. Changing the port only hides the service and does not limit who can connect.

Question 26Security Operations⚑ Flag

What is the defining characteristic of software-defined networking (SDN) that makes it useful for automated security responses such as quarantining a host?

AIt replaces every physical switch with a virtual appliance hosted in the cloud BEach device is assigned a VLAN by MAC address when it first boots CA central controller manages forwarding separately from the data plane DIt encrypts all switch-to-switch traffic with mutually authenticated TLS

Correct answer: C. A central controller manages forwarding separately from the data plane
SDN separates the control plane, which decides how traffic flows, from the data plane that forwards it, with a centralized programmable controller. That lets security tools push policy changes such as isolating a host through an API. Encryption between switches is not what defines SDN.

Question 27Security Operations⚑ Flag

While reviewing EDR telemetry at Westbrook Capital, an analyst sees 7z.exe compress 2,400 files from a finance share into a password-protected archive named 'cache01.tmp' in C:\ProgramData\. The archive is split into 100 MB parts, and the same host later opens many outbound connections to a file-sharing site. What does this activity MOST likely represent?

ARoutine archiving by a backup agent BData staged and split for exfiltration CRansomware encrypting the finance share DDisk cleanup compressing temporary files

Correct answer: B. Data staged and split for exfiltration
Gathering many sensitive files into a password-protected, split archive with a misleading name in an unusual folder, then sending data out, is a typical exfiltration staging pattern. Ransomware encrypts files in place on the share, while this activity copied them into a new archive and then transferred data externally.

Question 28Reporting & Communication⚑ Flag

Bayfield City shares a 911 dispatch system with the neighboring county under a memorandum of understanding. The MOU requires 30 days' notice and joint approval before any change to the system. A scan finds a high-severity vulnerability on the dispatch server. How should the analyst handle the remediation timeline?

AAsk the county to take full ownership of fixing the vulnerability BLeave the finding open with no target date until the MOU expires CPatch immediately, because public safety systems must stay secure DStart the MOU change process and report the delay as an inhibitor

Correct answer: D. Start the MOU change process and report the delay as an inhibitor
An MOU is a formal agreement, so the analyst must follow its change process and report it as a documented inhibitor that explains the longer timeline. Patching without joint approval violates the agreement and could disrupt a shared critical service.

Question 29Incident Response⚑ Flag

A responder at Everly Credit Services must image a hard drive removed from a suspect's workstation. Opposing counsel is expected to argue that the drive was altered during collection. Which tool should the responder use when connecting the drive to the forensic workstation?

AA hardware write blocker BA secure wipe utility CA disk encryption utility DA file carving utility

Correct answer: A. A hardware write blocker
A hardware write blocker allows reads from the drive but stops any writes, so the original evidence is not changed when it is attached. File carving is an analysis technique for recovering data and offers no protection during acquisition.

Question 30Vulnerability Management⚑ Flag

Under CVSS v3.1, a vulnerability in a hypervisor lets code running inside a guest virtual machine affect the host and other guests. How should the analyst set the Scope metric?

AChanged, because the attacker needs high privileges to run code inside the guest system BChanged, because exploitation affects resources under a different security authority CUnchanged, because the hypervisor and the guests run on the same physical hardware DUnchanged, because the attacker already has code execution inside the guest machine

Correct answer: B. Changed, because exploitation affects resources under a different security authority
In CVSS v3.1, Scope is Changed when exploiting a flaw in one component lets the attacker affect resources governed by a different security authority, as in a guest-to-host escape. Sharing physical hardware does not place the guest and host in the same security scope.

Question 31Security Operations⚑ Flag

Attackers using adversary-in-the-middle phishing kits have stolen session cookies from several employees at Northgate Media, even though push-notification MFA was enabled. Which authentication change would BEST resist this technique?

AFIDO2 passkeys that are cryptographically bound to the site origin BLonger passwords combined with a mandatory ninety-day rotation policy CSMS one-time passcodes sent to each employee's registered mobile phone DTime-based one-time passcodes generated by a mobile authenticator app

Correct answer: A. FIDO2 passkeys that are cryptographically bound to the site origin
FIDO2 authenticators sign a challenge that includes the website origin, so the credential will not work on a look-alike proxy domain. SMS and app-based codes can be typed into the phishing page and relayed in real time, so they do not stop adversary-in-the-middle attacks.

Question 32Incident Response⚑ Flag

Analysts at Pemberton Shipping are building a timeline from firewall logs recorded in UTC, a Linux server logging in Pacific time and a Windows host whose clock drifted four minutes. Events appear to happen in an impossible order. What should the analysts do FIRST?

ADiscard the Windows logs, since that host's clock was not synchronized BAnalyze each log source on its own timeline to avoid confusion CUse only the firewall logs because they already record in UTC DConvert all timestamps to UTC and correct for the clock drift

Correct answer: D. Convert all timestamps to UTC and correct for the clock drift
Correlating events across sources requires a common time reference, so analysts convert everything to UTC and correct for known drift. Discarding the drifted host's logs would throw away evidence that is still usable once the four-minute offset is applied.

Question 33Vulnerability Management⚑ Flag

A vulnerability in the document viewer used by Ostrava Media can be exploited only if an employee opens a specially crafted file received by email. Which CVSS base metric captures this requirement?

AUser Interaction BAttack Vector CPrivileges Required DAttack Complexity

Correct answer: A. User Interaction
User Interaction measures whether a person other than the attacker must take an action, such as opening a file, for the exploit to succeed. Attack Complexity covers conditions beyond the attacker's control in the target environment, not actions taken by a victim.

Question 34Security Operations⚑ Flag

The application log for Cobalt Ridge Bank's loan portal shows 1,800 requests in 15 minutes from one IP address. Each request hits /search with parameter values containing quotes and phrases such as OR 1=1, and many return HTTP 500 database errors. What does this pattern MOST likely indicate?

ACredential stuffing against the portal's login form BA cross-site scripting attempt aimed at the portal's users CAutomated SQL injection probing of the search feature DA faulty code release that broke the search page

Correct answer: C. Automated SQL injection probing of the search feature
A high volume of requests from one source carrying SQL syntax, combined with database errors, points to automated SQL injection testing. Cross-site scripting would show script tags or JavaScript in the parameters, not SQL logic meant to alter a database query.

Question 35Reporting & Communication⚑ Flag

Fenwick Plastics runs an injection molding line 24 hours a day, six days a week. A critical patch for the line's HMI workstations requires a reboot that would stop production for 45 minutes, and the plant manager objects to an unplanned stop. What should the analyst recommend?

APatch during the weekly shutdown and add interim controls until then BExempt the HMI workstations from patching on a permanent basis CReplace the HMI workstations with new hardware before any patching DForce the reboot now, since critical patches override operations

Correct answer: A. Patch during the weekly shutdown and add interim controls until then
Business process interruption is a common inhibitor, and the usual answer is to patch in a planned maintenance window while compensating controls reduce risk until then. A permanent exemption leaves the vulnerability open indefinitely and is not a reasonable trade for a 45-minute stop.

Question 36Incident Response⚑ Flag

A compromised virtual machine at Quarry Lane Software is running in a public cloud. The team wants to cut it off from the network immediately but keep it running so they can capture memory. Which action BEST meets this goal?

ACopy its startup logs to storage and then terminate the instance BRemove only its public IP address and leave its other network rules in place CStop the instance and then restart it inside an isolated private subnet DAssign a quarantine security group that permits only forensic access

Correct answer: D. Assign a quarantine security group that permits only forensic access
Swapping the instance's security group for a deny-all quarantine group cuts off attacker traffic while the instance keeps running, so memory and other volatile data stay intact. Stopping the instance to move it would clear its memory and lose the evidence the team wants.

Question 37Vulnerability Management⚑ Flag

A vendor confirms that attackers are actively exploiting an unpatched flaw in the VPN appliance used by Merriweather Foods. No patch will be available for at least a week, but the vendor has published a configuration workaround. What should the analyst recommend FIRST?

AWait for the official patch, since workarounds are not formally tested by the change board BApply the vendor's workaround and increase monitoring of the appliance until a patch ships CLower the finding's priority because no CVSS score has been published for the flaw yet DReplace the appliance with a different vendor's product before the end of the business day

Correct answer: B. Apply the vendor's workaround and increase monitoring of the appliance until a patch ships
With a zero-day under active exploitation, compensating controls such as the vendor workaround and closer monitoring reduce risk until a fix exists. Waiting a week would leave an internet-facing system exposed to a flaw that attackers are already using.

Question 38Security Operations⚑ Flag

Calder Analytics monitors its data center with a physical network tap at the core switch. An internal investigation reveals malicious traffic between two virtual machines on the same hypervisor host that never appeared in the tap's captures. What is the BEST way to close this visibility gap?

AEnable NetFlow export on the perimeter firewall's outside interface BAdd a second physical tap on the internet-facing edge router CMonitor traffic at the hypervisor's virtual switch layer DIncrease the packet capture buffer size on the existing core tap

Correct answer: C. Monitor traffic at the hypervisor's virtual switch layer
Traffic between VMs on the same host passes through the hypervisor's virtual switch and never reaches physical network hardware. Mirroring or monitoring at the virtual switch captures this east-west traffic. A larger buffer on the physical tap cannot capture packets that never cross it.

Question 39Security Operations⚑ Flag

A phishing report at Tavira Medical contains a link that the email client displays as 'northbank.com', the bank the clinic uses for payroll. In the raw message source, the link's hostname starts with 'xn--' followed by a string of letters and digits. What does this MOST likely indicate?

AA URL shortener that hides the final destination BA homoglyph domain built from look-alike characters CBase64 encoding that conceals a query string DA tracking prefix added by the mail gateway

Correct answer: B. A homoglyph domain built from look-alike characters
The 'xn--' prefix marks Punycode, the ASCII form of an internationalized domain name, so the link likely uses Unicode look-alike characters to imitate the real bank domain. A URL shortener hides the destination behind a different short domain and would not display as the bank's own name.

Question 40Reporting & Communication⚑ Flag

At Castellan Media, every patch must go through a change advisory board that meets once a month. A vulnerability that is being actively exploited in the wild was found on public web servers, but the next meeting is 25 days away. What is the BEST course of action?

APatch without any approval and write up the change afterward BTake the web servers offline until the CAB meeting takes place CWait for the next CAB meeting to stay within governance rules DUse the emergency change process defined in the change policy

Correct answer: D. Use the emergency change process defined in the change policy
Organizational governance can slow remediation, so mature change programs include an emergency change path for urgent risks like actively exploited flaws. Skipping approval entirely bypasses governance and can cause unmanaged outages.

Question 41Incident Response⚑ Flag

While investigating unauthorized API activity, the team at Juno Biotech learns that the cloud provider keeps the default management event history for only 90 days. The suspicious activity started about 80 days ago. What should the team do FIRST?

AIncrease the logging verbosity on all virtual machines in the account BExport the relevant audit logs to immutable, access-controlled storage CTake screenshots of the console event history for the suspicious period DAsk the cloud provider to extend the default retention for this account

Correct answer: B. Export the relevant audit logs to immutable, access-controlled storage
Copying the logs to immutable storage preserves them before the retention window deletes the earliest events, and it protects them from tampering. Asking the provider to change default retention may not be possible and would not happen fast enough to save the oldest records.

Question 42Vulnerability Management⚑ Flag

During a scheduled maintenance window, the team at Cobalt Transit applies an operating system patch to its dispatch servers. Afterward, the dispatch application fails to start, and the window closes in 40 minutes. What should the team do?

ALeave the patch in place and notify users that dispatch will be unavailable until next week BApply additional untested patches from the vendor in the hope that one resolves the conflict CExecute the documented rollback plan to restore service, then investigate the failure DKeep troubleshooting past the window, since reverting the patch would reopen the vulnerability

Correct answer: C. Execute the documented rollback plan to restore service, then investigate the failure
A rollback plan exists so the team can restore a critical service within the approved window when a change fails. The vulnerability stays open for a short time and can be covered by compensating controls until a retest, while an extended dispatch outage is not acceptable.

Question 43Security Operations⚑ Flag

The security team at Wexford Travel wants to learn quickly if any public certificate authority issues a TLS certificate for its domains without approval. Such a certificate could indicate a phishing setup or a compromised registrar account. Which source should the team monitor?

ACertificate transparency logs BThe internal CA's revocation list COCSP responses for its own web servers DThe DNS zone file for its primary domain

Correct answer: A. Certificate transparency logs
Publicly trusted certificate authorities submit issued certificates to public certificate transparency logs, so monitoring them reveals unexpected certificates for the organization's domains. The internal CA's revocation list only covers certificates the company issued itself.

Question 44Vulnerability Management⚑ Flag

An analyst at Pemberton Clinics wants vulnerability scores to reflect that an affected database stores regulated patient records, which makes confidentiality especially important to the organization. Which group of CVSS metrics should the analyst adjust?

ABase impact metrics BThreat or temporal metrics CBase exploitability metrics DEnvironmental metrics

Correct answer: D. Environmental metrics
Environmental metrics let an organization adjust a score for its own setting, including security requirements such as high confidentiality for patient data. Base impact metrics describe the flaw itself and stay the same in every environment.

Question 45Incident Response⚑ Flag

Malware is found on an HMI workstation that controls a packaging line at Northfield Foods. Shutting it down would halt production, and the vendor does not support endpoint agents on it. What is the BEST containment option?

ASegment the HMI with ACLs that permit only required control traffic BShut down the HMI and run the line manually until it is rebuilt CLeave the HMI as is and schedule cleanup for the next planned outage DInstall a standard antivirus agent on the HMI despite vendor support terms

Correct answer: A. Segment the HMI with ACLs that permit only required control traffic
Segmentation with tight access control lists limits what the malware can reach while the line keeps running, which balances containment against production needs. Leaving the HMI unchanged until a planned outage allows the infection to spread or cause damage in the meantime.

Question 46Security Operations⚑ Flag

An analyst at Fairhaven Hospital needs to record all traffic between a suspect Linux server and 203.0.113.50 so it can be reviewed later in Wireshark. The server has no graphical interface. Which command BEST meets this need?

Atcpdump -i eth0 -r suspect.pcap host 203.0.113.50 Btcpdump -i eth0 -w suspect.pcap port 203.0.113.50 Ctcpdump -i eth0 -w suspect.pcap host 203.0.113.50 Dnetstat -an | grep 203.0.113.50 > suspect.pcap

Correct answer: C. tcpdump -i eth0 -w suspect.pcap host 203.0.113.50
The -w option writes raw packets to a pcap file that Wireshark can open, and the host filter limits the capture to traffic to or from that IP. The -r option reads an existing capture file instead of recording a new one, so it would not collect any traffic.

Question 47Reporting & Communication⚑ Flag

The SOC at Delmar Freight measures response as the time from detection to containment. Last month's four incidents took 2, 4, 6, and 12 hours. What mean time to respond should appear in the monthly metrics report?

A12 hours B24 hours C5 hours D6 hours

Correct answer: D. 6 hours
Mean time to respond is an average, so 24 total hours divided by four incidents equals 6 hours. Five hours is the median of the values, which is a different statistic.

Question 48Security Operations⚑ Flag

At Bramley Foods, a production storage bucket in the company's public cloud account was deleted overnight. The incident lead needs to know which identity made the API call, from what IP address and at what time. Which log source is MOST useful?

AVirtual network flow logs for the storage subnet BOperating system logs from the application servers CThe web application firewall's blocked request logs DThe cloud provider's control plane audit logs

Correct answer: D. The cloud provider's control plane audit logs
Control plane audit logs, such as AWS CloudTrail, record management API calls with the calling identity, source IP and timestamp. Flow logs show network connections between addresses, but not which identity performed an API action like deleting a bucket.

Question 49Vulnerability Management⚑ Flag

A penetration test of Wrenfield Credit's online banking site shows that a malicious web page can make a logged-in customer's browser submit a funds transfer without the customer's knowledge. Which mitigation BEST addresses this weakness?

AUse parameterized queries for every transfer so input cannot alter the database command BRequire anti-CSRF tokens on state-changing requests and set the SameSite attribute on cookies CEnforce TLS on all banking pages so that transfers cannot be intercepted while in transit DEncode all customer-supplied data before it is written back into the account summary page

Correct answer: B. Require anti-CSRF tokens on state-changing requests and set the SameSite attribute on cookies
Cross-site request forgery relies on the browser automatically sending session cookies, so an unpredictable per-request token and SameSite cookies let the server reject forged requests. Output encoding addresses cross-site scripting, which is a different weakness.

Question 50Incident Response⚑ Flag

At Bramwell Accounting, analysts find a keylogger on 15 workstations that captured domain credentials. The IT manager wants to reset all affected passwords immediately, before the malware is removed. Why is this sequence a problem?

AUsers will be locked out until the workstations are fully re-imaged BResetting passwords will delete forensic evidence stored on the hosts CThe keylogger could capture the new passwords as users type them DPassword changes cannot replicate while malware runs on endpoints

Correct answer: C. The keylogger could capture the new passwords as users type them
If the keylogger is still running, users typing new passwords hand them straight to the attacker, so credentials should be reset after the malware is removed or from clean systems. Resetting passwords does not destroy disk or memory evidence on the infected hosts.

Question 51Security Operations⚑ Flag

Hollis Manufacturing detonates a suspicious attachment in its sandbox, and the report shows no network activity, no file changes and a clean verdict. Static analysis of the same file finds checks for virtualization artifacts and a 20-minute sleep timer. What is the BEST next step?

ADelete the sample so no one can run it by accident BBlock the sender's domain and close the case CRelease the file to users because the sandbox verdict was clean DRerun it with a longer runtime and anti-evasion settings

Correct answer: D. Rerun it with a longer runtime and anti-evasion settings
Checks for virtual machine artifacts and a long sleep are common sandbox evasion tricks, so a clean result from a short run does not prove the file is safe. Rerunning with a longer runtime and anti-evasion settings, or on bare metal, gives it a chance to show real behavior, while releasing it trusts a result the malware was built to fake.

Question 52Reporting & Communication⚑ Flag

The weekly KPI dashboard at Arbor Valley Hospital shows that SIEM alert volume dropped 70 percent overnight, and no tuning changes were made. The SOC director wants to report this as an improvement. What should the analyst do FIRST?

AReassign half of the SOC analysts to other projects this month BReport the drop as proof that the detection rules now work well CConfirm that all log sources are still sending data to the SIEM DLower alert thresholds to bring volume back to its normal level

Correct answer: C. Confirm that all log sources are still sending data to the SIEM
A sudden drop in alert volume with no tuning changes often means a log source or collector stopped forwarding data. Reporting it as success before validating ingestion could hide a real visibility gap.

Question 53Vulnerability Management⚑ Flag

Code review of Halcyon Legal's document portal shows that the download feature builds a file path by appending a user-supplied filename to /var/app/docs. A scanner confirmed that the feature can return files outside that folder. Which fix BEST prevents this?

ARename the documents folder to a random value that attackers are unlikely to guess BResolve the canonical path and reject any request that falls outside the documents folder CStrip the string ../ from the filename once before building the path to the requested file DServe the download feature over HTTPS so that requested file names cannot be observed

Correct answer: B. Resolve the canonical path and reject any request that falls outside the documents folder
Canonicalizing the path resolves encodings and relative segments, so the application can verify that the final location stays inside the allowed directory. Removing ../ a single time is easy to bypass with nested or encoded sequences.

Question 54Incident Response⚑ Flag

Ransomware encrypted Fenwick Legal's document servers on March 20. Investigation shows the attacker first gained access and planted a backdoor on February 26. Nightly backups are kept for 60 days. Which backup should the team restore from?

AThe backup from March 19, the last night before encryption BThe most recent backup that is not encrypted, whatever its date CA backup from before February 26, scanned before it is restored DAny backup from March, since the backdoor was inactive then

Correct answer: C. A backup from before February 26, scanned before it is restored
Backups taken after February 26 likely contain the attacker's backdoor, so restoring them would bring the attacker back. The March 19 backup has the least data loss, but it is not known-good because the compromise was already present.

Question 55Security Operations⚑ Flag

Tilden Health's application logs include full Social Security numbers, and those logs are forwarded to a SIEM that many analysts and a managed service provider can access. Compliance asks the SOC to reduce exposure without losing the ability to correlate events by patient. What is the BEST approach?

AReplace the numbers with consistent tokens before ingestion BLimit SIEM access to analysts who have completed HIPAA training CEnable full-disk encryption on all of the SIEM storage volumes DStop forwarding all of the application's logs to the SIEM entirely

Correct answer: A. Replace the numbers with consistent tokens before ingestion
Tokenizing sensitive values at ingestion keeps the real numbers out of the SIEM, while a consistent token still lets analysts link events for the same patient. Full-disk encryption protects stored data from physical theft, but every authorized SIEM user would still see the numbers in clear text.

Question 56Vulnerability Management⚑ Flag

A scan of Ironbridge Publishing's legacy PHP site shows that a page parameter is passed directly to an include statement, and the server will load a script hosted on an outside domain. Which change BEST mitigates this remote file inclusion risk?

AIncrease the PHP memory limit so included scripts cannot exhaust server resources BDisable allow_url_include and map page parameter values to an allowlist of local files CEnable directory listing so administrators can review which files are being included DMove the include statement into a separate file that only the web server can read

Correct answer: B. Disable allow_url_include and map page parameter values to an allowlist of local files
Turning off remote URL includes stops PHP from loading code from other servers, and an allowlist ensures the parameter can only select approved local pages. Moving the include into another file does not change the fact that user input controls what gets loaded.

Question 57Incident Response⚑ Flag

Attackers exploited a flaw in a customer portal at Ironwood Mutual. The vendor says a patch will not be available for three weeks, but the business needs the portal back online after recovery. Which action BEST reduces risk until the patch is released?

AUse a WAF rule to virtually patch the flaw, with added monitoring BRestore the portal and require all customers to reset their passwords CKeep the portal offline until the vendor finally releases the patch DRestore the portal and rely on daily antivirus scans of the web server

Correct answer: A. Use a WAF rule to virtually patch the flaw, with added monitoring
A WAF rule acts as a compensating control or virtual patch, blocking the exploit path while the real fix is pending, and added monitoring catches attempts to bypass it. Antivirus scans of the server would not stop the application flaw from being exploited again.

Question 58Security Operations⚑ Flag

The SOC at Tamarack Utilities wants one alert when a single account fails VPN login more than 20 times within 10 minutes and then succeeds from the same source IP. On their own, failed and successful logons are far too noisy to alert on. Which capability BEST meets this requirement?

AA vulnerability scan scheduled against the VPN gateway BA file integrity monitoring policy on the VPN appliance CA SIEM correlation rule tied to a time window DA DLP rule that inspects VPN traffic for sensitive data

Correct answer: C. A SIEM correlation rule tied to a time window
A correlation rule links related events, here many failures followed by a success from one source, inside a defined time window, turning noisy single events into one high-confidence alert. File integrity monitoring tracks changes to files on a system and cannot tie authentication events into a sequence.

Question 59Reporting & Communication⚑ Flag

After a ransomware incident, Kestrel Medical's IR lead finishes a detailed technical report with IoCs, exploited weaknesses and admin account names. Several department heads ask for copies. How should the report be handled?

ADelete it once the lessons-learned meeting is complete BPost it on the intranet so every employee can learn from it CEmail the full report to every department head who asks DMark it confidential and limit the full version to need-to-know

Correct answer: D. Mark it confidential and limit the full version to need-to-know
A technical incident report reveals weaknesses and account details that would help a future attacker, so it should be classified and shared only with those who need it. Department heads can receive a summary instead of the full version.

Question 60Security Operations⚑ Flag

An incident response firm finds that attackers spent 14 months inside Ardent Aerospace's engineering network. They used custom malware, moved slowly to avoid detection and exfiltrated only design files for a defense program. No ransom was demanded. Which threat actor type is MOST likely responsible?

AHacktivist collective seeking public attention BUnskilled attacker using commodity tools CFinancially motivated organized crime group DNation-state advanced persistent threat

Correct answer: D. Nation-state advanced persistent threat
Long dwell time, custom tooling, stealth and theft of defense-related intellectual property are hallmarks of a nation-state APT focused on espionage. Organized crime groups seek profit and usually monetize access quickly through ransomware, fraud or selling data.

Question 61Vulnerability Management⚑ Flag

A security review of Thornbury Telecom's account portal finds that the session identifier assigned before login stays the same after the user authenticates. Which change BEST addresses this weakness?

AIssue a new session identifier immediately after successful authentication BLengthen the session timeout so users are not forced to log in as often CStore the session identifier in a URL parameter so the server can validate it more easily DEncrypt the password field on the login form using a client-side script

Correct answer: A. Issue a new session identifier immediately after successful authentication
Keeping the pre-login identifier allows session fixation, where an attacker who planted or learned that ID inherits the authenticated session. Regenerating the ID at login breaks that link, while URL-based session IDs would make leakage even more likely.

Question 62Incident Response⚑ Flag

The CISO at Rosewood Hotels wants to confirm that executives, legal, PR and IT understand their roles during a ransomware incident. The exercise must not affect production systems and should be low cost. Which type of exercise is MOST appropriate?

AA red team engagement BA tabletop exercise CA parallel recovery test DA full interruption test

Correct answer: B. A tabletop exercise
A tabletop exercise is a discussion-based walkthrough of a scenario, which is ideal for checking roles and decisions without touching live systems. A full interruption test actually shuts down primary operations, so it is costly and risky for this goal.

Question 63Security Operations⚑ Flag

Two analysts at Pemberton Logistics each collect a copy of 'invoice_viewer.exe' from different infected hosts. Both copies have the same file name and size, but their SHA-256 values differ. What is the MOST accurate conclusion?

ATheir file system timestamps changed the hash values BSHA-256 output varies each time the same file is hashed CThey are identical, because name and size both match DTheir contents differ, even if only by a few bytes

Correct answer: D. Their contents differ, even if only by a few bytes
A cryptographic hash is computed only from a file's contents, so different SHA-256 values mean the bytes differ, as with repacked or polymorphic malware. File system timestamps are metadata kept outside the file content, so they do not change the hash.

Question 64Vulnerability Management⚑ Flag

A software composition analysis report shows that Grayson Freight's customer app depends on a web framework version that reached end of life last year. The maintainers no longer publish security fixes for that version. What is the BEST long-term remediation?

AAdd the framework to an allowlist so the scanner stops reporting the issue BCopy the framework source into the project so the team owns the codebase CPlan and complete an upgrade to a supported, maintained version of the framework DKeep the current version, since no new CVEs have been reported for it yet

Correct answer: C. Plan and complete an upgrade to a supported, maintained version of the framework
End-of-life components receive no security patches, so any flaw found in the future will stay open permanently. A lack of reported CVEs does not mean the code is safe, only that new issues will never be fixed by the maintainers.

Question 65Reporting & Communication⚑ Flag

The final incident report at Ashgrove Retail must state the attacker's dwell time. Forensics shows initial access on March 2, the SOC detected the activity on April 13, and containment finished on April 15. What dwell time should the report list?

A2 days B42 days C44 days D13 days

Correct answer: B. 42 days
Dwell time runs from initial compromise to detection: March 2 to April 13 is 42 days. Counting through containment gives 44 days, which mixes dwell time with response time.

Question 66Security Operations⚑ Flag

A threat intelligence platform at Brookhaven Savings generates a high-priority alert about a new campaign exploiting a flaw in an industrial control system controller. The bank has no operational technology and does not use that vendor. Which intelligence quality factor does this alert fail?

AAccuracy BAttribution CRelevancy DTimeliness

Correct answer: C. Relevancy
Relevancy measures whether intelligence applies to the organization's assets, industry and threat profile. The report may be timely and accurate, but a bank with no industrial control systems cannot act on it.

Question 67Incident Response⚑ Flag

An IDS at Fallbrook Logistics alerts on an exploit attempt for a known Apache Struts flaw against a web server. The analyst confirms the server runs a different framework, the request returned an error, and no follow-up activity occurred. How should the analyst classify this?

AA security event with no impact, documented and closed BA confirmed incident that requires full containment CA false negative that needs a new IDS signature DA data breach that triggers customer notification

Correct answer: A. A security event with no impact, documented and closed
The attempt was real but could not succeed against software that is not present and caused no impact, so it is an event rather than an incident. Declaring full containment would waste response effort on an attack that failed.

Question 68Vulnerability Management⚑ Flag

A credentialed scan of a Linux server at Mosswood Bank finds a shell script that runs every hour as root through cron. The script file is world-writable. What should the analyst recommend?

AChange the cron schedule so the script runs once each day instead BMake the script owned by root and writable only by root CAdd a comment to the script warning users not to edit its contents DRename the script so it is harder for ordinary users to locate it

Correct answer: B. Make the script owned by root and writable only by root
Any user who can edit a script that root executes can run commands as root, which is a privilege escalation path. Restricting ownership and write permission to root removes that path, while running the script less often only slows the abuse.

Question 69Security Operations⚑ Flag

Analysts at Ellison Healthcare switch between six consoles: SIEM, EDR, email security, firewall, ticketing and threat intel. Every investigation requires copying data between them by hand, and alerts are often missed. Which approach BEST addresses this problem?

AIntegrate the tools by API into a single pane of glass BReplace the SIEM with a second EDR product from another vendor CExport each console's alerts to a shared spreadsheet daily DAssign each analyst to watch only one of the six consoles

Correct answer: A. Integrate the tools by API into a single pane of glass
API and webhook integrations let alerts and context from each tool flow into one console, a single pane of glass, which cuts manual copying and the chance of missing an alert. Splitting the consoles among analysts keeps the data siloed, so no one sees the full picture of an incident.

Question 70Reporting & Communication⚑ Flag

A local reporter calls a SOC analyst at Kestrel Telecom asking about rumors of a data breach. The incident is still under investigation, and the IR plan names a designated spokesperson. How should the analyst respond?

AAsk the reporter where the rumor started, then end the call BConfirm only the facts the analyst has personally verified CDecline to comment and refer the reporter to the spokesperson DDeny the breach to prevent panic until the investigation ends

Correct answer: C. Decline to comment and refer the reporter to the spokesperson
IR communication plans route media inquiries through a designated spokesperson, often in public relations, so messages are accurate, consistent, and reviewed by legal. Sharing even verified facts can release incomplete information and create legal exposure.

Question 71Incident Response⚑ Flag

When should a lessons learned meeting for a major incident ideally take place?

ADuring containment, so improvements can be applied to the ongoing response BWithin a few days after the incident is resolved, while details are fresh CAt the next annual security review, alongside other yearly findings DOnly after any related legal proceedings have fully concluded

Correct answer: B. Within a few days after the incident is resolved, while details are fresh
NIST guidance recommends holding the lessons learned meeting soon after the incident ends, while participants still remember what happened and why decisions were made. Waiting for an annual review lets details fade and delays fixes for the weaknesses the incident exposed.

Question 72Security Operations⚑ Flag

The detection engineering team at Morrow Logistics keeps writing rules for file hashes and IP addresses from intel reports, but attackers change them within days. The team wants detections that stay useful longer and impose more cost on adversaries. What should the team focus on?

ALarger hash blocklists that are refreshed every hour BDomain names rather than IP addresses as the main indicator CSignatures that match each new malware sample's file size DBehavior-based rules built on the adversary's TTPs

Correct answer: D. Behavior-based rules built on the adversary's TTPs
TTPs describe how an adversary operates, and they are much harder to change than hashes, IPs or domains, which sit low on the Pyramid of Pain. Switching to domains helps slightly, but attackers can still register new domains cheaply.

Question 73Vulnerability Management⚑ Flag

Sablewood Retail retrains its product recommendation model every week using customer reviews and click data. Analysts notice that a group of new accounts has been submitting coordinated fake reviews that skew the model's output. Which control BEST mitigates this risk?

AValidate training data sources and screen for anomalies before every retraining run BRetrain the model daily instead of weekly so that bad data is replaced more quickly CEncrypt the trained model file at rest so that attackers cannot read its parameters DIncrease the size of the model so the fake reviews have a smaller relative influence

Correct answer: A. Validate training data sources and screen for anomalies before every retraining run
Data poisoning corrupts a model through its training inputs, so checking data provenance and filtering anomalous records before training addresses the cause. Encrypting the model protects its confidentiality but does nothing about corrupted training data.

Question 74Incident Response⚑ Flag

After a breach at Vantage Point Credit, the team learns the attacker used a credential dumping tool that is recompiled for each target, so its hash changes every time. Which detection improvement would be MOST durable?

AA SIEM alert on the file name the attacker gave the dumping tool BA behavior rule that alerts on processes reading LSASS memory CA blocklist containing the dumping tool's file hash from this incident DA firewall rule that blocks the attacker's command-and-control IPs

Correct answer: B. A behavior rule that alerts on processes reading LSASS memory
Detecting the behavior, such as an unusual process accessing LSASS memory, catches the technique no matter how the tool is recompiled or renamed. A hash blocklist only stops that exact build, which the attacker already changes for every target.

Question 75Vulnerability Management⚑ Flag

Juniper Health is starting a new patient scheduling platform. The CISO wants to find design flaws, such as missing trust boundaries and weak authentication flows, when they are cheapest to fix. When should the team perform threat modeling?

AAfter deployment, during the first annual penetration test BDuring user acceptance testing, just before the go-live date CAfter the first security incident, as part of lessons learned DDuring the design phase, before significant code is written

Correct answer: D. During the design phase, before significant code is written
Threat modeling during design finds architectural weaknesses, such as insecure design, before they are built into the code, when changes cost the least. Waiting for a penetration test after deployment means flaws surface when fixing them requires rework in production.

Question 76Security Operations⚑ Flag

Before closing a ticket, a Tier 1 analyst at Norcross Bank reviews an AI assistant's incident summary. It states the host 'downloaded payload.dll from 198.51.100.23 at 14:05,' but the analyst cannot find that IP or file anywhere in the proxy, DNS or EDR logs for the host. What is the MOST appropriate action?

AEscalate to Tier 2 as a confirmed malware infection case BAssume the logs are incomplete and keep the AI version CBlock the IP at once, since the AI is likely accurate DTreat it as unverified and fix the ticket from raw logs

Correct answer: D. Treat it as unverified and fix the ticket from raw logs
AI tools can produce plausible but invented details, so a finding the source data does not support must be treated as a possible hallucination and checked against raw logs before it drives action. Blocking the IP or declaring an infection based only on the summary would act on evidence that may not exist.

Question 77Reporting & Communication⚑ Flag

Thornbury Credit is preparing to notify members whose data was stolen in a breach. The FBI agent working the case asks the company to delay the notice because it could tip off suspects the agency is tracking. What should the company do?

ADocument the request and delay notice as the law permits BIgnore the request, since agencies cannot affect notice timing CCancel the member notice, since the FBI now owns the incident DNotify members right away, since breach laws never allow delays

Correct answer: A. Document the request and delay notice as the law permits
Many breach notification laws allow a delay when law enforcement determines that notice would impede a criminal investigation, and the request should be documented, ideally in writing. Notifying right away ignores a legitimate legal exception and could compromise the investigation.

Question 78Security Operations⚑ Flag

A SIEM rule at Pellham Biotech flags one workstation sending thousands of DNS TXT queries per hour to a single external domain. Each query has a long, random-looking subdomain, such as a91f3c7e2b...data.example-cdn.net. What is the MOST likely explanation?

ANormal CDN load balancing for a busy website BA misconfigured internal DNS forwarder CData exfiltration through DNS tunneling DA DHCP lease renewal storm on that subnet

Correct answer: C. Data exfiltration through DNS tunneling
High volumes of TXT queries with long encoded subdomains to one domain are a classic sign of DNS tunneling, where data is packed into the query names. CDN traffic uses short, readable hostnames and normal record types, so it does not produce this pattern.

Question 79Incident Response⚑ Flag

A finance clerk at Marlow Industries wired $186,000 to a new vendor account after receiving an email that appeared to come from the CFO. Two hours later, the real CFO confirms he never sent the request. What should the company do FIRST?

AContact the bank's fraud team to request a wire recall BSearch all mailboxes for other emails from the spoofed sender CPublish an internal notice warning staff about the scam DReset the CFO's password and enable multifactor authentication

Correct answer: A. Contact the bank's fraud team to request a wire recall
Recovering funds is time-sensitive, and banks have the best chance of freezing or reversing a fraudulent wire when contacted right away. Securing the CFO's account is also needed, but it does not bring back the money, and the recall window can close within hours.

Question 80Vulnerability Management⚑ Flag

The infrastructure team at Lockhart Logistics reports that it has applied patches for 37 critical findings on its web servers. The analyst needs to close the related tickets. What should the analyst do FIRST?

AClose the tickets right away, since the infrastructure team confirmed it BRescan the affected servers and confirm the vulnerabilities are resolved CWait for the next quarterly scan cycle to see whether the findings remain DAsk the server vendor for a letter certifying the patches were successful

Correct answer: B. Rescan the affected servers and confirm the vulnerabilities are resolved
A validation rescan provides evidence that each fix worked, since patches can fail, need a reboot or miss some hosts. Closing tickets on the team's word alone risks leaving critical vulnerabilities open without anyone noticing.

Question 81Security Operations⚑ Flag

An analyst at Quintero Insurance wants a free public AI chatbot to help decode a suspicious PowerShell script found on a claims server. The script contains internal hostnames, a service account name and the path to a customer database. What should the analyst do?

APaste the full script, since public chatbots never keep inputs BUse an approved AI tool, or redact sensitive details first CUse a personal chatbot account so the request is not logged DSend the script to an outside contractor for a quick review

Correct answer: B. Use an approved AI tool, or redact sensitive details first
Pasting internal hostnames, account names and data paths into a public AI service can expose them outside company control, because inputs may be stored or used for training. The analyst should use an approved tool with proper data handling or strip the sensitive details, since there is no basis for assuming a public chatbot keeps nothing.

Question 82Reporting & Communication⚑ Flag

Two weeks after closing a credential stuffing incident, the IR manager at Pembrook Games holds a lessons-learned meeting with everyone who worked the case. What is the PRIMARY outcome this meeting should produce?

ARestored service on the systems hit by the attack BA list of staff who made mistakes, for disciplinary review CImprovement actions for controls and the IR plan DA press release explaining the incident to customers

Correct answer: C. Improvement actions for controls and the IR plan
A lessons-learned review examines what worked and what failed so the team can improve controls, detection, and the IR plan. A blame-focused list discourages honest input and is not the goal of the review.

Question 83Security Operations⚑ Flag

Orchard Valley Utilities has a small hunt team with time for one focused hunt this quarter. The environment includes a guest Wi-Fi network, a marketing web server and a billing database holding payment data for 300,000 customers. Leadership's top concern is a breach of customer payment data. Where should the team focus FIRST?

AThe guest Wi-Fi network, since it has the most connected devices BThe billing database and the systems that can reach it CThe marketing web server, since it is exposed to the internet DEmployee laptops, since they receive the most phishing emails

Correct answer: B. The billing database and the systems that can reach it
With limited resources, hunts should focus on business-critical assets where a compromise would cause the most harm, including the paths that lead to them. The internet-facing marketing server is a likely entry point, but hunting around the billing database covers attackers who arrive through any route.

Question 84Incident Response⚑ Flag

Delmont Water is terminating a network administrator who has threatened to retaliate. He has domain admin rights, VPN access and knows the passwords for several shared device accounts. When should his access be removed?

AAfter his manager reviews which of his accounts are still in use BAt the end of his last day, once knowledge transfer is complete CWithin a week, after HR finishes processing the exit paperwork DAs he is notified, with shared device passwords rotated as well

Correct answer: D. As he is notified, with shared device passwords rotated as well
Removing all access, including shared credentials he knows, at the same time he is notified prevents a hostile insider from using remaining access to cause damage. Waiting until the end of the day gives him hours of privileged access after learning about the termination.

Question 85Vulnerability Management⚑ Flag

Fairmont Games wants ongoing security testing of its public game platform by a large, diverse group of outside researchers. It wants to pay only for valid, unique findings rather than for time spent. Which program BEST fits these goals?

AA bug bounty program with a defined scope and clear rules of engagement BA vulnerability scanning subscription that runs automated weekly scans CA fixed-price penetration test performed by one consulting firm each year DAn internal red team exercise run by the company's own security staff

Correct answer: A. A bug bounty program with a defined scope and clear rules of engagement
A bug bounty program rewards outside researchers for each valid finding and provides continuous testing from many perspectives under a clear scope and rules. A penetration test is time-boxed and paid for effort, no matter how many issues are found.