You are configuring Microsoft Defender for Endpoint (MDE) to restrict USB storage access on corporate-managed Windows endpoints. Which policy setting should you configure in the Microsoft Intune Endpoint Security portal to ensure only authorized hardware IDs are permitted while blocking all others?
You are performing a credentialed vulnerability scan using Nessus Professional on a Linux server. The scan reports that the 'Remote Windows SMB' service is missing patches, but the target is Linux. What is the most likely cause of this discrepancy?
While monitoring security logs in Splunk for your critical database server, you observe a spike in '401 Unauthorized' errors followed by a '200 OK' success from a known administrative account. How should you investigate this to confirm a potential credential stuffing attack?
You are implementing 'Just-in-Time' (JIT) access for Azure Virtual Machines using Microsoft Defender for Cloud. A developer complains they cannot request access to a VM. What is the most likely reason?
You are troubleshooting a failure in a 'Certificate-Based Authentication' setup for a VPN. The logs show 'Handshake Failure'. What tool should you use to verify the server's certificate chain status?
During an internal audit of a financial services firm, the security operations team must ensure that the cryptographic keys used to encrypt customer payment data at rest are properly secured. The keys are stored on a Hardware Security Module (HSM). Which of the following controls BEST ensures that the keys cannot be extracted or misused even if an attacker gains root access to the application server that uses the HSM?
A CCOA analyst is investigating an alert indicating that a domain controller's NTDS.dit file was accessed by a non-standard process. The analyst suspects an attempt to extract credential hashes. Which of the following techniques is most likely being used by the attacker?
A security analyst is reviewing the configuration of a critical Windows server that hosts a database. The server is part of an Active Directory domain. The analyst notices that the local Administrator account is enabled and has a weak password. Which of the following actions BEST mitigates the risk of lateral movement using this account while maintaining operational requirements?
A security analyst is configuring a new endpoint detection and response (EDR) solution. The analyst needs to ensure that the EDR agent can detect malicious PowerShell scripts that are obfuscated. Which of the following capabilities is most critical for this requirement?
A company is migrating its on-premises file server to a cloud-based object storage service. The security team must ensure that data at rest is encrypted and that access is controlled based on user identity. Which of the following configurations BEST meets these requirements?
A security analyst is implementing a privileged access management (PAM) solution to secure administrative accounts in an Active Directory environment. The analyst must ensure that the solution enforces the principle of least privilege and provides accountability. Which two of the following controls are most critical to achieve these goals? (Choose two.)
A cloud security engineer is reviewing the configuration of an object storage bucket that holds customer invoices. The bucket is intended to be private, but a recent assessment found that objects were reachable by anyone who knew the URL. The engineer confirms that no bucket policy or access control list grants public access and that all access goes through signed requests. Which configuration issue is the MOST likely cause of the unintended exposure?
A CCOA analyst is reviewing Group Policy settings for a Windows Server 2022 domain controller. The organization wants to ensure that all domain-joined workstations enforce a minimum password length of 14 characters and lock out accounts after 5 failed attempts. Which of the following is the MOST appropriate location to configure these settings to ensure they apply to all domain users?
A security operations analyst is configuring a new Windows Server 2022 file server that will store financial records. The organization's policy requires that all file shares containing financial data be encrypted at rest and that access be restricted to authorized finance personnel only. The analyst needs to implement these controls using native Windows features. Which combination of technologies should the analyst use to meet these requirements?
A CCOA analyst is configuring access control for a critical database server. The organization requires that only members of the 'DB_Admins' group can log in interactively, while members of the 'App_Service' group can only connect via a specific application service account. Which of the following access control models BEST fits this requirement?
You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?
You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?
You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?
You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?
You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?
During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?
When setting up a new security monitoring tool, you need to define 'Critical Assets'. Which criteria should NOT be used to determine asset criticality?
You need to ensure that all endpoints in your organization have the 'CrowdStrike Falcon' agent running and are reporting correctly. Which dashboard should you use?
You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?
You are reviewing a list of vulnerabilities found by an automated scanner. Which type of vulnerability would be considered the most critical to remediate first?
You notice a surge in outbound traffic from a workstation to a series of random external IP addresses. This suggests a potential botnet infection. What is the most appropriate forensic data to collect first?
You are configuring an Endpoint Security policy to harden Windows 10 devices. Which TWO of the following settings are recommended as best practice to mitigate physical access risks?
You are setting up a secure baseline for a new server. You need to ensure the operating system logs are sent to a centralized logging server. Which service should you configure?
You are hardening a Linux server and want to disable all unused network ports. Which command would be best to identify listening ports and their associated processes?
Your vulnerability management program requires prioritizing fixes based on exploitability. Which THREE of the following factors should be included in your risk score?
You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?
You are performing a vulnerability assessment on a server. Which TWO of the following indicators would suggest an asset is part of the 'Critical' category?
A security operations analyst is reviewing the configuration of a newly deployed Windows Server 2022 file server that stores PII. The server has SMB signing disabled. Which of the following best describes the primary risk of leaving SMB signing disabled in this environment?
A security analyst is reviewing the configuration of a Windows Server 2022 file server that stores HR records. The server is a member of an Active Directory domain. The analyst finds that the local Administrators group contains the domain group 'Helpdesk_Tier1'. Helpdesk technicians need to reset user passwords and unlock accounts, but they should not have full control over the HR file server. Which action should the analyst take to enforce least privilege while preserving the technicians' ability to perform their duties?
A CCOA analyst is investigating suspicious activity on a Linux web server running Apache. The analyst runs 'ss -tulpn' and sees that the server is listening on port 8443, but the organization's asset inventory lists this server as only providing HTTP on port 80 and HTTPS on port 443. The analyst needs to determine which process is bound to port 8443 and whether it is authorized. Which command should the analyst use next to identify the process name and PID associated with port 8443?
A CCOA analyst is configuring centralized logging for a fleet of Linux servers that host sensitive customer data. The organization must ensure that authentication events and privilege escalation attempts are captured for security monitoring and compliance. Which two log sources should the analyst prioritize to detect unauthorized access and privilege escalation attempts? (Choose two.)
You are the cybersecurity operations analyst for a hospital network. A workstation in the radiology department was compromised and used to pivot to the PACS image archive. During the post-incident review, the CISO asks which control would have most directly limited the attacker's ability to move laterally from the workstation to the archive server. Which of the following should you recommend?
A CCOA analyst is helping to classify assets for a new cybersecurity program. The organization wants to identify which assets are most critical so that protection and monitoring efforts can be prioritized. Which criterion is the MOST appropriate basis for classifying an asset as high criticality?
During an incident response engagement, an analyst must preserve volatile evidence from a compromised Windows workstation before containment. The system has been running for 36 hours and the analyst needs to capture the current state of active network connections and the processes that own them, in a form that can be used for later forensic review. Which built-in Windows utility should the analyst run first to capture this volatile data?
A financial services firm is inventorying its assets for a new risk assessment. The analyst must classify each asset by data sensitivity and business criticality. Which of the following best represents a 'Confidential' data classification for an asset in this environment?
A CCOA analyst is reviewing endpoint hardening for a Windows 10 workstation used by a developer. The developer needs to run locally compiled binaries for testing but should not be able to bypass security controls. The analyst wants to prevent unauthorized executables from running while allowing approved development tools. Which Windows feature should the analyst configure to enforce application control based on code signing and reputation?
A security operations center (SOC) analyst is triaging an alert indicating that a user's workstation has been infected with malware that is attempting to communicate with a command-and-control (C2) server. The analyst wants to quickly identify the process responsible for the network connection. Which of the following tools is MOST appropriate for this task on a Windows system?
A security operations team is designing the asset inventory for a hybrid environment that includes on-premises servers, cloud workloads, and employee-owned mobile devices. The team wants to ensure the inventory supports both vulnerability management and incident response. Which data element is MOST important to include for every asset so that responders can quickly determine ownership and escalation paths during an incident?
A manufacturing company is building a hardened baseline for its industrial control system (ICS) engineering workstations, which run Windows and connect to programmable logic controllers on the plant floor. The security team must reduce the attack surface without disrupting production. Which two controls are most appropriate to include in the baseline for these workstations? (Choose two.)
A security operations analyst is reviewing the hardening posture of a fleet of Windows Server 2022 hosts that run a custom line-of-business application requiring the legacy SMBv1 dialect for backward compatibility with an old vendor appliance. Leadership has approved a time-boxed exception but wants compensating controls. Which action BEST reduces the attack surface while honoring the approved exception?
A security operations center (SOC) analyst is reviewing firewall logs and notices that a workstation is making repeated connections to a known malicious IP address on port 443. The analyst wants to quickly identify the process responsible for these connections on the Windows workstation. Which of the following tools should the analyst use?
A retail company stores payment card data in a database on a Linux server. The security team must ensure that the database files themselves are protected if the underlying storage is physically stolen or a disk image is copied. Which control best addresses this specific threat?
A security analyst is reviewing the configuration of a Windows file server that stores personnel records. The analyst wants to verify that only members of the HR group can read the payroll folder and that all other authenticated users are explicitly denied access. Which type of access control model is being applied when permissions are assigned directly to named users and groups on each file and folder?
During a control review, an analyst finds that a privileged service account used by a backup platform has a password that has not rotated in three years and is stored in a plaintext configuration file on a management server. The backup platform cannot support modern authentication methods. Which compensating control BEST addresses the credential risk without breaking the backup jobs?
A security operations center is establishing a baseline for privileged account management across its server estate. The team must reduce the risk that compromised administrative credentials lead to widespread lateral movement. Which TWO controls should the team implement to directly limit the blast radius of a compromised privileged account? (Choose two.)
A cloud operations team manages thousands of container workloads in Kubernetes. The CISO wants to reduce the risk that a compromised container image introduces vulnerabilities into production. The team already scans images in the CI pipeline before deployment. Which additional control most directly addresses the risk of images being replaced or tampered with after scanning but before running?
A security operations analyst is building a data classification and handling standard for a new document management platform that stores contracts, HR records, and public marketing collateral. The analyst must define controls that apply to the highest sensitivity tier. Which TWO actions are appropriate for assets classified at the highest sensitivity level? (Choose two.)
A security operations team is implementing a new endpoint detection and response (EDR) solution. They need to ensure that the EDR agent has the necessary visibility to detect malicious activity and that the collected data is protected. Which TWO of the following actions are MOST critical to achieve these goals? (Choose two.)
A security operations analyst is onboarding a new subsidiary and must inventory its assets before applying controls. The subsidiary has a mix of physical servers, virtual machines, and cloud instances, and the analyst needs an authoritative record of what exists, who owns each asset, and how it is classified. Which action is the FIRST step in establishing this asset inventory?
A security operations analyst is reviewing how a critical database server is protected. The server stores customer payment data and runs on a hardened host, but the analyst notices that the database service account can read its own data files directly from the file system, and that backup images of the volume are stored unencrypted on a shared network share. Which change MOST directly reduces the risk of bulk data exposure from a stolen backup image?
A security operations analyst at a healthcare organization is reviewing asset inventory records and discovers a database server that stores electronic protected health information (ePHI). The server is not tagged with any data classification label, and the analyst needs to ensure it complies with the organization's data classification policy before it is connected to the production network. Which action should the analyst take FIRST according to data classification and handling best practices?
A CCOA analyst is reviewing a vulnerability scan report for a web server that hosts a public-facing application. The scan identified several vulnerabilities, including a critical remote code execution (RCE) flaw in a web framework, a medium-severity cross-site scripting (XSS) issue, and a low-severity information disclosure in an HTTP header. The RCE vulnerability has a known exploit available in the wild, but the web framework is only used for an internal administrative interface that is not accessible from the internet. The XSS vulnerability is on a public login page. Which vulnerability should the analyst prioritize for immediate remediation based on risk?
A security operations analyst is implementing a new endpoint detection and response (EDR) solution. The analyst must ensure that the EDR agent cannot be disabled by local administrators on endpoints. Which of the following is the MOST effective control to prevent tampering with the EDR agent?
A CCOA analyst is reviewing the security posture of a web server that hosts a public-facing application. The analyst discovers that the server has unnecessary services running, including Telnet and FTP. Which of the following actions should the analyst recommend FIRST to reduce the attack surface?
A CCOA analyst is reviewing the organization's asset inventory practices. The analyst needs to identify TWO practices that are essential for maintaining an accurate and up-to-date asset inventory. (Choose two.)
A security operations analyst is implementing a hardening baseline for a fleet of Linux servers that host a web application. The organization wants to minimize the attack surface by disabling unnecessary services and configuring secure settings. The analyst has already disabled Telnet and FTP. Which additional action should the analyst take to align with the principle of least functionality?