Mobile Devices practice questions

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Trap 1: Only the user's browser cache

Browser cache is not the authoritative source for sign-in and mailbox-rule activity.

Trap 2: The organisation's public DNS zone file

DNS zone data is unrelated to mailbox-forwarding abuse.

Trap 3: Only DHCP logs from the London office

DHCP logs cannot explain the remote sign-in or mailbox change.

A
Only the user's browser cache
Why wrong: Browser cache is not the authoritative source for sign-in and mailbox-rule activity.
B
The organisation's public DNS zone file
Why wrong: DNS zone data is unrelated to mailbox-forwarding abuse.
C
Sign-in logs, MFA result, device details, and mailbox audit events
Impossible travel plus forwarding rule creation is a strong account-compromise pattern; identity and mailbox audit data confirm whether the activity is malicious.
D
Only DHCP logs from the London office
Why wrong: DHCP logs cannot explain the remote sign-in or mailbox change.

Question 2mediummultiple choice

During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Trap 1: Prioritize only the source with the highest EPS

Event volume does not determine chronological accuracy.

Trap 2: Assume the firewall logs are falsified

Time-order issues are often configuration problems, not proof of tampering.

Trap 3: Delete one source from the timeline

Removing telemetry reduces evidence quality.

A
Prioritize only the source with the highest EPS
Why wrong: Event volume does not determine chronological accuracy.
B
Time synchronization and timezone normalization across log sources
Clock drift and timezone parsing commonly distort event order in SIEM timelines.
C
Assume the firewall logs are falsified
Why wrong: Time-order issues are often configuration problems, not proof of tampering.
D
Delete one source from the timeline
Why wrong: Removing telemetry reduces evidence quality.

Question 3hardmulti select

A vulnerability scan of a segmented OT network must avoid disrupting fragile devices. Which controls are appropriate? (Choose two.)

Trap 1: Scan from random external hosts

Uncontrolled scanning can create operational and safety risk.

Trap 2: Run aggressive exploit checks without approval

Exploit checks may disrupt fragile systems.

A
Use approved safe-check profiles or passive discovery where required
Non-intrusive methods reduce disruption risk.
B
Scan from random external hosts
Why wrong: Uncontrolled scanning can create operational and safety risk.
C
Run aggressive exploit checks without approval
Why wrong: Exploit checks may disrupt fragile systems.
D
Coordinate test windows and scope with OT owners
OT environments require strict change and safety coordination.

Question 4mediummultiple choice

During a vulnerability assessment, a security analyst discovers that a network device is running an outdated firmware version with known exploits. The device is critical to production and cannot be rebooted during business hours. Which of the following is the BEST approach to remediate this vulnerability?

Trap 1: Apply the firmware patch immediately without rebooting

Firmware updates typically require a reboot to take effect.

Trap 2: Implement a virtual patch via the IDS/IPS until a full patch is…

Virtual patching is a compensating control, not a remediation.

Trap 3: Request a hotfix from the vendor that does not require a reboot

Hotfixes are not always available and may still require a reboot.

A
Schedule the firmware upgrade during the next maintenance window
This balances security with operational continuity.
B
Apply the firmware patch immediately without rebooting
Why wrong: Firmware updates typically require a reboot to take effect.
C
Implement a virtual patch via the IDS/IPS until a full patch is possible
Why wrong: Virtual patching is a compensating control, not a remediation.
D
Request a hotfix from the vendor that does not require a reboot
Why wrong: Hotfixes are not always available and may still require a reboot.

Question 5easymulti select

A company is implementing a vulnerability management program. Which of the following are essential components of a vulnerability management lifecycle? (Choose three.)

Trap 1: Penetration testing on all systems.

Separate assessment, not part of continuous lifecycle.

Trap 2: Automated patch deployment.

Part of remediation but not a distinct lifecycle phase.

A
Vulnerability scanning and assessment.
Core activity to identify vulnerabilities.
B
Discovery and inventory of assets.
Essential first step to know what to scan.
C
Penetration testing on all systems.
Why wrong: Separate assessment, not part of continuous lifecycle.
D
Remediation and verification.
Closes the lifecycle by fixing and confirming.
E
Automated patch deployment.
Why wrong: Part of remediation but not a distinct lifecycle phase.