Which of the following best describe Mitigate and Transfer?

Cloudflare hired a new intern, Alvin, and his saw a bunch of machines needed updates. He decided to update everything. Once the updates started, he locked his computer, and went to lunch.

What did Alvin forget to do? (Select Multiple)

A security analyst plans to deploy a critical patch across 200 production servers. The operations team insists that business applications must remain available during peak hours. Which of the following is the best action for the analyst to take?

During an investigation, an analyst sees the attacker scanned ports 21, 22, 80, 443, and 3389. What phase of the attack does this activity most closely represent?

A security analyst wants to build an inventory of all systems on the network without sending packets to end devices. Which technique should the analyst use?

A company wants to evaluate whether the SOC can detect lateral movement and privilege escalation techniques used by real-world attackers. Which engagement is MOST appropriate?

A monitoring dashboard shows that a web application maintained 99.4% availability over the last 30 days. What does this metric represent?

An internal IT team commits to keeping authentication latency below 200 ms for internal apps. This is not legally binding but is used for performance tracking. What is this commitment called?

A developer modifies a login page so that the username field only accepts letters and numbers. If the user enters symbols like " ; " or " ' ", the request is rejected. What security control is being used?

A security team identifies the attacker’s infrastructure, including their C2 servers and VPN exit nodes. Which Diamond Model component does this describe?

If you want to a manual on security testing and assessment, which of the following would offer you a systematic approach?

A SOC analyst receives threat intelligence indicating that a phishing campaign is targeting the company. The report assigns a high confidence level to the indicators. Which of the following BEST describes what this confidence level indicates?

A SOC analyst collects IP addresses, domains, and malware hashes from publicly available blogs, Twitter feeds, and threat forums. Which type of intelligence is this?

Analysts are searching Tor forums and underground marketplaces for indicators of compromised credentials or leaked customer data. Which type of intelligence are they gathering?

A SOC analyst receives a report indicating a new ransomware variant targeting financial institutions. The analyst uses this report to update detection rules and monitor systems. What activity is this?

A SOC team deploys honeypots to attract attackers and learn their methods before they reach production systems. Which type of active defense is this?

After detecting ransomware encrypting files, the SOC team immediately isolates the infected host and restores backups. What type of defense is this?

A SOC team configures endpoints to send logs to a central SIEM for analysis. Which term BEST describes this process?

An analyst notices that logs from multiple servers show inconsistent timestamps. Which configuration must be verified to correct this issue?

A company implements a policy where users must authenticate and be authorized every time they access any resource, regardless of network location. Which security model does this describe?

Which of the following is typically included in a SUSE deployment?

Luke Skyrunner was able to log in once this morning and access his email, VPN, and HR system without entering credentials again. What is this an example of?

Becky was using her corporate credentials to log in to third-party SaaS applications without creating a separate account. Which technology is being used?

A company wants to monitor and enforce security policies for employees using multiple cloud applications. Which solution BEST fits this requirement?

Which of the following actions is not typically performed by a DLP system?

Which of the following characteristics makes a task a good candidate for automation?

A company integrates its SIEM, endpoint detection system, and firewall on a platform. When an alert triggers, the platform automatically collects logs, enriches the alert with TI data, and blocks malicious IPs. This is an example of:

A SOC analyst receives an alert about a suspicious IP. The security system automatically queries threat intelligence feeds, malware databases, and related domains to provide additional context. What is this process called?

A webhook is MOST useful in which of the following cases?

A security team wants to identify all devices on its network, including unauthorized IoT devices that employees may have connected without approval. Which technique is MOST appropriate?

A vulnerability scanner logs into a Linux server using SSH keys and examines configuration files, patch levels, and installed software versions. This is an example of:

True or False: Agentless Scanning requires the installation of software or network devices in order to complete the scan.