10 practice questions with answers and explanations.
An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?
The correct answer is B. Option B: Reconnaissance
An analyst wants to ensure that users only leverage web-based software that has been pre-approved by the organization. Which of the following should be deployed?
The correct answer is B. Option B: Allowlisting
During a cybersecurity incident, one of the web servers at the perimeter network was affected by ransomware. Which of the following actions should be performed immediately?
The correct answer is C. Option C: Quarantine the server. This option keeps traffic private / properly secured as required.
An organization recently changed its BC and DR plans. Which of the following would best allow for the incident response team to test the changes without any impact to the business?
The correct answer is A. Option A: Perform a tabletop drill based on previously identified incident scenarios.
Security analysts review logs on multiple servers on a daily basis. Which of the following implementations will give the best central visibility into the events occurring throughout the corporate environment without logging in to the servers individually?
The correct answer is B. Option B: Configure the servers to forward logs to a SIEM
Explanation
A SIEM centralizes and correlates security events to support detection, investigation, and reporting. This option keeps traffic private / properly secured as required.
A web application team notifies a SOC analyst that there are thousands of HTTP/404 events on the public-facing web server. Which of the following is the next step for the analyst to take?
The correct answer is D. Option D: Identify the IP/hostname for the requests and look at the related activity
Which of the following best describes the reporting metric that should be utilized when measuring the degree to which a system application, or user base is affected by an uptime availability outage?
The correct answer is C. Option C: Impact
A security analyst needs to provide evidence of regular vulnerability scanning on the company's network for an auditing process. Which of the following is an example of a tool that can produce such evidence?
The correct answer is A. Option A: OpenVAS This option keeps traffic private / properly secured as required.
A security analyst performs a vulnerability scan. Based on the metrics from the scan results, the analyst must prioritize which hosts to patch. The analyst runs the tool and receives the following output: Which of the following hosts should be patched first, based on the metrics?
The correct answer is C. Option C: host03 This option keeps traffic private / properly secured as required.
An organization receives a legal hold request from an attorney. The request pertains to emails related to a disputed vendor contract. Which of the following is the best step for the security team to take to ensure compliance with the request?
The correct answer is B. Option B: Notify the departments involved to preserve potentially relevant information This option keeps traffic private / properly secured as required.
Showing questions 1–10 of 10 · Page 1 of 1