328 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.
This is exactly what you see during practice — question, options, and a full explanation after you answer.
You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?
A beaconing pattern with a consistent 30-second interval and 5% jitter is best detected through frequency analysis on connection flow metadata, since the regularity of the timing is the defining characteristic. Analyzing flow records (NetFlow, Zeek conn.log) for periodic connecti…Read full explanation
An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?
A sinkhole IP is a controlled address that security teams or law enforcement redirect malicious traffic to, typically to neutralize botnet C2 communications. When an internal host repeatedly attempts to contact a known sinkhole IP, it strongly indicates the host is infected with …Read full explanation
A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?
Multiple failed login attempts followed by a successful login from an unknown IP is a textbook indicator of unauthorized access — specifically a brute-force or password-spraying attack that eventually succeeded. This pattern is categorized as an unauthorized access attempt IoC be…Read full explanation
Questions are tagged by exam domain. Practice a specific domain or mix them all.
Answer at your own pace. Explanation and domain tag shown immediately after each answer.
Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.
Full explanations on every question
Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.
Domain score breakdown
After each session see your score by exam domain so you know exactly where to focus study time.
100% free, forever
No subscription, no trial, no email wall. Start a session in under 10 seconds.
Exam-style questions
Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.