After a phishing email is opened, a message appears demanding Bitcoin to unlock files. Which immediate action should a technician take FIRST?

Which network protocol weakness did the WannaCry outbreak exploit?

Which of the following MOST likely represents malware that masquerades as legitimate software while installing a backdoor?

Which indicator MOST likely reveals a Trojan infection?

A finance PC shows encrypted HTTPS traffic to rare domains overseas. Which malware type is MOST likely responsible?

Which malware type self-replicates without user action and can quickly saturate bandwidth?

Which control MOST effectively prevents a worm outbreak from spreading?

Which malware type requires user execution of an infected file to spread?

Which network symptom MOST likely indicates a worm infection?

Which of the following BEST describes spyware?

Which control MOST effectively mitigates spyware?

Software pre-installed by vendors that slows performance is BEST categorized as:

Which mitigation MOST likely prevents unwanted bundled installations?

Which malware captures keyboard input and stores it in plain text?

An analyst observes text files updating in C:\Temp as a user types. Which malware is MOST likely present?

A logic bomb can be BEST described as code that:

Which historical incident involved a fired employee activating a logic bomb?

Rootkits primarily attempt to:

Which observation MOST likely indicates a rootkit?

Which remediation step is MOST reliable for confirmed rootkit infections?

Which malware used digitally signed drivers to conceal industrial sabotage?

Periodic encrypted DNS queries to rare domains from several hosts MOST likely indicate:

Which botnet architecture is MOST resilient against single-server takedowns?

A botnet performing crypto-mining primarily affects which security objective?

Which tool would MOST likely detect a worm’s lateral movement across subnets?

Which detection method MOST effectively identifies encrypted C2 traffic?

Which malware goal is to deceive users into running malicious code disguised as useful software?

Which security control MOST effectively prevents Trojans from email attachments?

Malware that operates entirely in memory by abusing system tools is BEST described as:

Which indicator MOST likely reveals a keylogger dropped by a Trojan?

Which mitigation MOST effectively limits a worm’s lateral spread after infection?

Which malware family commonly uses DLL injection or kernel manipulation to remain hidden?

Why are immutable backups critical when mitigating ransomware?

Which log pattern MOST likely suggests active C2 beaconing?

Analysts determine that a PowerShell script executed from a temporary folder immediately after a phishing email was opened. Which phase of the attack lifecycle does this MOST likely represent?

Which control would MOST likely prevent malware from maintaining persistence through registry run keys?

Privilege escalation attempts exploiting unsigned drivers can BEST be mitigated by:

An analyst observes the process chain winword.exe → powershell.exe → cmd.exe on a host. This activity MOST likely indicates which attack technique?

Applying the principle of least privilege MOST directly mitigates which phase of an attack?

Which single control MOST effectively limits data exfiltration during the impact phase of an attack?

Packed executables with random filenames in %AppData% MOST likely indicate which evasion technique?

Which malware type MOST commonly modifies system utilities to conceal malicious processes?

Which practice MOST effectively prevents logic bombs in production software?

Correlating synchronized beacon timing across multiple hosts would MOST likely detect:

Which component of a malware campaign maintains communication with attacker infrastructure?

Which control combination MOST effectively prevents reinfection following a ransomware incident?

Spyware that injects DLLs into browser processes is BEST detected through:

Why are PUPs considered a potential security risk even when not directly malicious?

Which key distinction differentiates a worm from a Trojan?

Which toolset provides the MOST complete visibility into C2 beacon behavior?

A malicious macro creates a hidden Windows service that runs after reboot. This action MOST likely represents which attack phase?

Which configuration change MOST effectively mitigates “living-off-the-land” fileless attacks?

Which event MOST likely marks the impact stage of a ransomware attack?

Which control MOST effectively prevents privilege escalation through vulnerable drivers?

TLS traffic with mismatched SNI and JA3 signatures MOST likely indicates:

Which of the following MOST likely explains why network segmentation is critical once a worm is detected on a corporate subnet?

Which well-known malware specifically targeted industrial control systems to cause physical damage?

Which technique do many botnets use to remain reachable even after security teams block their domains?

Which combination of controls MOST effectively limits ransomware damage and prevents botnet persistence?

Multiple endpoints show encrypted files and ransom notes, but backups are intact. Which immediate coordinated action should responders take FIRST?

Users report browser redirects and credential theft. EDR logs show browserhelper.dll loading at startup. Which malware type is MOST likely present?

A workstation contacts a known phishing domain every 90 seconds while idle, and CPU usage stays high. Which issue is MOST likely occurring?

During forensics, investigators find a disabled service created five days before a ransomware detonation that auto-enabled on the attack day. Which artifact does this BEST represent?

An employee installs a “free PDF converter,” after which pop-ups and slow performance begin. What infection vector and malware type are MOST likely?

After removing a rootkit, EDR still flags unsigned drivers loading at boot. Which remediation step should be taken NEXT?

A phishing email delivers a dropper that installs Emotet, which then spreads laterally and steals credentials. Which control could have prevented the initial compromise?

A network admin notices hundreds of outbound DNS requests to random .ru domains. Which mitigation should be implemented FIRST?

Behavior-based analytics flag hosts making abnormal beacon patterns and automatically isolate them. This protection primarily disrupts which attack phase?

A developer’s maintenance script deletes production files when a date variable resets to zero. Which preventative measure would MOST effectively catch this error before deployment?