1.

A recent zero-day vulnerability is being actively exploited, requires no user

interaction or privilege escalation, and has a significant impact to
confidentiality and integrity but not to availability. Which of the following CVE
metrics would be most accurate for this zero-day threat?
A. CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L
B. CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
C. CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H
D. CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H
2. Which of the following tools would work best to prevent the exposure of PII outside
of an organization?
A. PAM
B. IDS
C. PKI
D. DLP
3. An organization conducted a web application vulnerability assessment against the
corporate website, and the following output was observed:

Which of the following tuning recommendations should the security analyst share?
A. Set an HttpOnly flag to force communication by HTTPS
B. Block requests without an X-Frame-Options header
C. Configure an Access-Control-Allow-Origin header to authorized
domains
D. Disable the cross-origin resource sharing header
4. Which of the following items should be included in a vulnerability scan report?
(Choose two.)
A. Lessons learned

1
 B. Service-level agreement
C. Playbook
D. Affected hosts
E. Risk score
F. Education plan
5. The Chief Executive Officer of an organization recently heard that exploitation of
new attacks in the industry was happening approximately 45 days after a patch was
released. Which of the following would best protect this organization?
A. A mean time to remediate of 30 days
B. A mean time to detect of 45 days
C. A mean time to respond of 15 days
D. Third-party application testing
6. A security analyst recently joined the team and is trying to determine which
scripting language is being used in a production script to determine if it is malicious.
Given the following script:

Which of the following scripting languages was used in the script?

A. PowerShell
B. Ruby
C. Python
D. Shell script
7. A company's user accounts have been compromised. Users are also reporting
that the company's internal portal is sometimes only accessible through HTTP, other
times; it is accessible through HTTPS. Which of the following most likely describes
the observed activity?
A. There is an issue with the SSL certificate causing port 443 to become
unavailable for HTTPS access
B. An on-path attack is being performed by someone with internal access
that forces users into port 80
C. The web server cannot handle an increasing amount of HTTPS requests so it
forwards users to port 80
D. An error was caused by BGP due to new rules applied over the company's
internal routers
8. A security analyst is tasked with prioritizing vulnerabilities for remediation. The
relevant company security policies are shown below:
Security Policy 1006: Vulnerability Management
● The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and
Impact) to prioritize the remediation of security vulnerabilities.
● In situations where a choice must be made between confidentiality and
availability, the Company shall prioritize confidentiality of data over availability

2
 of systems and data.
● The Company shall prioritize patching of publicly available systems and
services over patching of internally available system.
● According to the security policy, which of the following vulnerabilities should
be the highest priority to patch?
A. Name: [Link] - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Internal System
B. Name: [Link] - CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
External System
C. Name: [Link] - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
External System
D. Name: [Link] -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Internal System
9. Which of the following will most likely ensure that mission-critical services are
available in the event of an incident?
A. Business continuity plan
B. Vulnerability management plan
C. Disaster recovery plan
D. Asset management plan
10. The Chief Information Security Officer wants to eliminate and reduce shadow IT
in the enterprise. Several high-risk cloud applications are used that increase the risk
to the organization. Which of the following solutions will assist in reducing the risk?
A. Deploy a CASB and enable policy enforcement
B. Configure MFA with strict access
C. Deploy an API gateway
D. Enable SSO to the cloud applications
11. An incident response team receives an alert to start an investigation of an
internet outage. The outage is preventing all users in multiple locations from
accessing external SaaS resources. The team determines the organization was
impacted by a DDoS attack. Which of the following logs should the team review first?
A. CDN
B. Vulnerability scanner
C. DNS
D. Web server
12. A malicious actor has gained access to an internal network by means of social
engineering. The actor does not want to lose access in order to continue the attack.
Which of the following best describes the current stage of the Cyber Kill Chain that
the threat actor is currently operating in?
A. Weaponization
B. Reconnaissance
C. Delivery
D. Exploitation
13. An analyst finds that an IP address outside of the company network that is being
used to run network and vulnerability scans across external-facing assets. Which of

3
the following steps of an attack framework is the analyst witnessing?
A. Exploitation
B. Reconnaissance
C. Command and control
D. Actions on objectives
14. An incident response analyst notices multiple emails traversing the network that
target only the administrators of the company. The email contains a concealed URL
that leads to an unknown website in another country. Which of the following best
describes what is happening? (Choose two.)
A. Beaconing
B. Domain Name System hijacking
C. Social engineering attack
D. On-path attack
E. Obfuscated links
F. Address Resolution Protocol poisoning
15. During security scanning, a security analyst regularly finds the same
vulnerabilities in a critical application. Which of the following recommendations would
best mitigate this problem if applied along the SDLC phase?
A. Conduct regular red team exercises over the application in production
B. Ensure that all implemented coding libraries are regularly checked
C. Use application security scanning as part of the pipeline for the CI/CD
flow
D. Implement proper input validation for any data entry form
16. An analyst is reviewing a vulnerability report and must make recommendations to
the executive team. The analyst finds that most systems can be upgraded with a
reboot resulting in a single downtime window. However, two of the critical systems
cannot be upgraded due to a vendor appliance that the company does not have
access to. Which of the following inhibitors to remediation do these systems and
associated vulnerabilities best represent?
A. Proprietary systems
B. Legacy systems
C. Unsupported operating systems
D. Lack of maintenance windows
17. The security team reviews a web server for XSS and runs the following Nmap
scan:

Which of the following most accurately describes the result of the scan?

4
 A. An output of characters > and " as the parameters used m the attempt
B. The vulnerable parameter ID [Link] and unfiltered
characters returned
C. The vulnerable parameter and unfiltered or encoded characters passed > and
" as unsafe
D. The vulnerable parameter and characters > and " with a reflected XSS
attempt
18. Which of the following is the best action to take after the conclusion of a security
incident to improve incident response in the future?
A. Develop a call tree to inform impacted users
B. Schedule a review with all teams to discuss what occurred
C. Create an executive summary to update company leadership
D. Review regulatory compliance with public relations for official notification
19. A security analyst received a malicious binary file to analyze. Which of the
following is the best technique to perform the analysis?
A. Code analysis
B. Static analysis
C. Reverse engineering
D. Fuzzing
20. An incident response team found IoCs in a critical server. The team needs to
isolate and collect technical evidence for further investigation. Which of the following
pieces of data should be collected first in order to preserve sensitive information
before isolating the server?
A. Hard disk
B. Primary boot partition
C. Malicious files
D. Routing table
E. Static IP address
21. Which of the following security operations tasks are ideal for automation?
A. Suspicious file analysis:
Look for suspicious-looking graphics in a folder.
Create subfolders in the original folder based on category of graphics found.
Move the suspicious graphics to the appropriate subfolder
B. Firewall IoC block actions:
Examine the firewall logs for IoCs from the most recently published zero-day
exploit
Take mitigating actions in the firewall to block the behavior found in the logs
Follow up on any false positives that were caused by the block rules

C. Security application user errors:

Search the error logs for signs of users having trouble with the security
application
D. Look up the user's phone number -
Call the user to help with any questions about using the application

5
 E. Email header analysis:
Check the email header for a phishing confidence metric greater than or
equal to five
Add the domain of sender to the block list
Move the email to quarantine

22. An organization has experienced a breach of customer transactions. Under the

terms of PCI DSS, which of the following groups should the organization report the
breach to?
A. PCI Security Standards Council
B. Local law enforcement
C. Federal law enforcement
D. Card issuer
23. Which of the following is the best metric for an organization to focus on given
recent investments in SIEM, SOAR, and a ticketing system?
A. Mean time to detect
B. Number of exploits by tactic
C. Alert volume
D. Quantity of intrusion attempts
24. A company is implementing a vulnerability management program and moving
from an on-premises environment to a hybrid IaaS cloud environment. Which of the
following implications should be considered on the new hybrid environment?
A. The current scanners should be migrated to the cloud
B. Cloud-specific misconfigurations may not be detected by the current
scanners
C. Existing vulnerability scanners cannot scan IaaS systems
D. Vulnerability scans on cloud environments should be performed from the
cloud
25. A security alert was triggered when an end user tried to access a website that is
not allowed per organizational policy. Since the action is considered a terminable
offense, the SOC analyst collects the authentication logs, web logs, and temporary
files, reflecting the web searches from the user's workstation, to build the case for
the investigation. Which of the following is the best way to ensure that the
investigation complies with HR or privacy policies?
A. Create a timeline of events detailing the date stamps, user account hostname
and IP information associated with the activities
B. Ensure that the case details do not reflect any user-identifiable
information Password protect the evidence and restrict access to
personnel related to the investigation
C. Create a code name for the investigation in the ticketing system so that all
personnel with access will not be able to easily identify the case as an HR-
related investigation
D. Notify the SOC manager for awareness after confirmation that the activity was
intentional

6
26. Which of the following is the first step that should be performed when
establishing a disaster recovery plan?
A. Agree on the goals and objectives of the plan
B. Determine the site to be used during a disaster
C. Demonstrate adherence to a standard disaster recovery process
D. Identify applications to be run during a disaster
27. A technician identifies a vulnerability on a server and applies a software patch.
Which of the following should be the next step in the remediation process?
A. Testing
B. Implementation
C. Validation
D. Rollback
28. The analyst reviews the following endpoint log entry:

Which of the following has occurred?

A. Registry change
B. Rename computer
C. New account introduced
D. Privilege escalation
29. A security program was able to achieve a 30% improvement in MTTR by
integrating security controls into a SIEM. The analyst no longer had to jump between
tools. Which of the following best describes what the security program did?
A. Data enrichment
B. Security control plane
C. Threat feed combination
D. Single pane of glass
30. Due to reports of unauthorized activity that was occurring on the internal network,
an analyst is performing a network discovery. The analyst runs an Nmap scan
against a corporate network to evaluate which devices were operating in the
environment. Given the following output:

7
Which of the following choices should the analyst look at first?
A. [Link] ([Link])

8
 B. [Link] ([Link])
C. [Link] ([Link])
D. [Link] ([Link])
E. p4wnp1_aloa.lan ([Link])
31. Which of the following is a type of proactive monitoring and uses
external agents to run scripted transactions against an application?
A. RUM
B. Synthetic transaction monitoring
C. Reverse Engineering
D. OWASP
32. Which of the following is an example of a cloud-based vulnerability
scanner?
A. OpenVAS
B. Qualys
C. Nikto
D. Nessus
33. Which step in the software development life cycle (SDLC) follows the
design step?

A. Gather requirements
B. Certify/Accredit
C. Develop
D. Test/Validate
34. Which of the following is the process of discovering and listing
information?
A. Escalation
B. Discovery
C. Enumeration
D. Penetration
35. Which of the following is a set of command-line tools you can use to
sniff WLAN traffic?

A. hping3
B. Aircrack-ng
C. Qualyys
D. Reaver
36. Which of the following is a data collection tool that allows you to use
longitudinal survey panels to track and monitor the cloud environment?
A. Prowler

9
 B. ScoutSuite
C. Pacu
D. Mikto
37. Which standard framework is used to communicate threat data using a
standardized lexicon, consisting of key domain and relationship objects, aiming for
flexibility, extensibility, and both human- and machine-readable data?
A. Structured Threat Intelligence Exchange (STIE)
B. Standard Threat Event Protocol (STEP)
C. Structured Threat Information Expression (STIX)
D. Secure Threat Communication Protocol (STCP)
38. During which phase of the Cyber Kill Chain does the attacker focus on gaining an
understanding of the target network's topology and key individuals with specific data
access?
A. Exploitation
B. Reconnaissance
C. Delivery
D. Command and Control (C2)
39. What cybersecurity framework, designed by Mandiant (now part of FireEye),
aims to facilitate the sharing and automated analysis of an attacker's Tactics,
Techniques, and Procedures (TTPs) and other indicators of compromise through a
machine-readable format?
A. STIX
B. OpenIOC
C. TAXII
D. Encryption
40. A security analyst is investigating a software vulnerability or exploit that is
previously unknown to the vendor, for which no patch or advisory has been issued,
and is often used by attackers to compromise systems. What type of vulnerability is
the analyst observing?
A. Legacy vulnerability
B. Day One vulnerability
C. Inherent vulnerability
D. Zero day vulnerability
41. What is the primary purpose of the 'Feedback' phase within the intelligence
cycle, which is used by government and business intelligence teams?
A. To evaluate the effectiveness of data collection methods
B. To refine requirements and improve the overall intelligence process
C. To distribute actionable intelligence to decision-makers
D. To execute technical collection methods and gather raw data
42. A cybersecurity expert is concerned about the potential threats posed by
incoming files and links. To bolster the organization's defense, the expert is
considering implementing a service that consolidates outcomes from various
antivirus scanners and URL/domain blacklisting services. What is the name of the

10
service that aligns with this description?
A. Google Safe Browsing
B. Cisco Talos
C. VirusTotal
D. Reputation Center
43. What formal mechanism is designed to enhance the sharing of threat information
and best practices among organizations by providing a standardized platform for
industry-specific communities to exchange information about their common
infrastructure?
A. Cybersecurity Forums
B. Information Security Organizations
C. Information Sharing and Analysis Centers (ISACs)
D. Industry Threat Networks
44. Cybersecurity experts are working on classifying indicators of compromise
(IOCs) based on the level of difficulty it would take for attackers to alter their
methods and strategies. This categorization model aims to provide insights into the
effort required by attackers to adapt their tactics. What is the name of this model that
is used for such classification purposes?
A. Pyramid of Pain
B. Pyramid of Protection
C. Defense in Depth Model
D. Threat Intelligence Framework
45. A detection analyst in a Security Operations Center (SOC) receives an alert
about a suspicious activity. The analyst has access to limited information, including a
headline of the activity and a few supporting artifacts. To enable the analyst to
quickly assess and respond to the alert, which of the following practices is
recommended?
A. Immediately perform manual steps to assimilate and correlate all available
data related to the alert
B. Rely solely on the provided artifacts and headline to make a decision about
the alert
C. Leverage automated threat intelligence to enrich the alert with relevant
external context
D. Escalate the alert to higher-level management for decision-making
46. An alert identifies users logging in from foreign countries who don't usually travel.
What kind of analysis is Olivia employing?
A. Behavior
B. Trend
C. Heuristic
D. Availability
47. Nathan realizes a user has executed a command on a Windows console. What
has transpired?
psexec \[Link] -u Administrator -p examplepw [Link]
A. The user opened a command prompt as administrator on their workstation.

11
 B. The user opened an interactive command prompt as administrator on a
remote workstation.
C. The user opened a command prompt on the desktop of a remote workstation.
D. The user opened a command prompt on their workstation.
48. You are analyzing the SIEM for your company's ecommerce server when you
notice the following URL in the logs of your SIEM:
[Link]
tity="100"+/><item+id="5&quantity=0
Based on this line, what type of attack do you expect has been attempted?
[Link] injection
[Link] overflow
[Link] injection
[Link] hijacking
49. If you want to conduct an operating system identification during a
Nmap scan, which syntax should you utilize?
[Link] -os
[Link] -O
[Link] -id
[Link] -osscan
50. Angelina's malware analysis tool uses a disassembler and binary differentiation.
What is the goal of this tool?
A. Binary fingerprinting to identify the malware author
B. Calculating minimum viable signature length
C. Heuristic code analysis of development techniques
D. Building a similarity graph of similar functions across binaries
51. Which of the following techniques listed below are not appropriate to
use during a passive reconnaissance exercise against a specific target
company?
[Link] lookups
[Link] grabbing
[Link] looking glass usage
[Link] checks

12