A cybercriminal creates a fake invoice with hidden malware and emails it to a company employee. This action is part of which stage in the Cyber Kill Chain?

You want to set up a system that can automatically block IP addresses when threats are detected and pull data from threat intelligence feeds. What solution is best for this?

You're troubleshooting a Linux server and want to capture real-time network packets to analyze strange traffic. What command-line tool should you use?

You receive an email that looks like it’s from your company's CEO, but your DNS security shows the sender’s IP is not part of the company’s authorized email servers. What is the most likely issue?

Your team is analyzing a cyber attack. They create a chart that connects the attacker, tools used, network, and victim. What model are they using?

You notice that a user’s machine is making regular connections to an external IP address every 5 minutes. What is this behavior called?

A company wants to make sure only approved devices can access the network. Which security technology will help stop rogue devices from connecting?

An employee’s computer has a scheduled task running every 15 minutes with a suspicious script name. No one from IT created it. What should be suspected?

You're unsure if a file you downloaded is safe. You upload it to VirusTotal, which scans it using several antivirus tools. What type of analysis are you performing?

A normal user suddenly has administrator privileges without any request or approval. What is this an example of?

You discover that a user’s computer is running a service on port 22 (SSH), which is not used in your organization. What kind of warning sign is this?

A technician finds an unfamiliar executable and wants to check for readable text or commands inside it. Which tool should they use?

Your organization uses a service that filters all internet traffic through a provider before it reaches your firewall. What is the purpose of this setup?

A technician sees high memory usage on a computer and suspects malware. Is this always a sure sign of an infection?

A user logs into their account in Texas, and five minutes later the same account logs in from Japan. What tool would help detect this suspicious behavior?

An organization wants to set rules for how to handle emails that fail SPF or DKIM checks. What should they use?

An analyst finds a compressed file containing personal data in a Windows temp folder. There are no known backup tasks. What could this indicate?

You want to see what apps are using the most memory on your Linux system. Which command will help?

Your security team sets up a fake server that pretends to be vulnerable. It soon starts receiving attack traffic. What kind of system is this?

After a serious incident, a report is written so managers can quickly understand what happened without too much technical detail. What is this part of the report called?

A finance department user’s computer is found to be sending traffic over IRC (Internet Relay Chat). What is this most likely a sign of?

After a ransomware attack at a local hospital, Aria from the IT team investigates and discovers that a misconfigured firewall allowed the attack to happen. What is this investigation step called?

You notice that the Windows UAC settings were changed to “Never Notify” without approval. What tool would most likely catch this unauthorized change?

During the infamous Equifax data breach in 2017, it was revealed that a critical patch had not been applied to a vulnerable version of Apache Struts, allowing attackers to exploit the vulnerability. In the aftermath, Equifax implemented additional controls to monitor traffic to and from the servers hosting the vulnerable software. In this context, what kind of incident response activity is Equifax performing?