During routine monitoring, an analyst detects a new device on the internal network that obtained an IP address from DHCP. The device begins generating lateral traffic and responding to ARP requests, but it is not listed in the asset inventory. Network segmentation policies are in place. Which action should the analyst take FIRST to confirm whether this device is rogue?

An organization experiences a sudden surge in inbound traffic that overwhelms its public-facing web servers. Logs show traffic originating from thousands of geographically dispersed IP addresses, many associated with consumer IoT devices. Internal systems remain unaffected. Which mitigation strategy would be MOST effective in this scenario?

A security analyst receives an alert that a Linux server is experiencing sustained high CPU and memory usage outside of normal business hours. The analyst runs the top command and observes a process with an unfamiliar name consuming resources continuously. No scheduled maintenance or updates are planned. What is the BEST next step to determine whether this activity is malicious?

During a routine security review, an analyst discovers a newly created Windows scheduled task that executes a PowerShell script every time the system reboots. The task is not documented, and the script establishes an outbound HTTPS connection to an unknown IP address. Which attacker objective is MOST likely associated with this activity?

An analyst investigating abnormal disk usage on a Windows workstation discovers several large, encrypted .rar files stored in the Recycle Bin. File timestamps show the files are recreated daily, and outbound HTTPS traffic increases shortly after. What does this MOST likely indicate?

A cybersecurity analyst is tasked with performing a vulnerability assessment on several Linux servers in a lab environment with limited budget. The organization prefers an open-source solution but wants the option to upgrade to a commercial version later if needed. Which tool BEST meets these requirements?

An analyst is performing a network scan and executes the following command: nmap -sU -p 161 192.168.1.50. The scan result shows that the port is open and responsive. What is the analyst MOST likely investigating?

An organization wants to assess how vulnerable its employees are to phishing attacks and determine whether recent security awareness training has been effective. The security team plans to simulate realistic attacks without causing operational disruption. Which approach BEST satisfies this goal?

A security analyst identifies multiple web application vulnerabilities during a scan. One vulnerability has a moderate CVSS score but affects a publicly accessible customer payment portal that stores sensitive financial data. Another vulnerability has a higher CVSS score but exists on an internal development server with no external access. Which factor should MOST influence the analyst’s remediation priority?

An analyst needs to actively test a web application for injection flaws, authentication weaknesses, and hidden content while intercepting and modifying HTTP requests in real time. Which tool is BEST suited for this task?

A web vulnerability scanner reports a potential SQL injection flaw in a production application. However, the application behaves normally during testing, and no data exposure can be confirmed. What should the analyst do NEXT?

A security analyst is assessing vulnerabilities in an organization’s public cloud environment. The analyst notes that patching the underlying hypervisor and physical infrastructure is managed by the cloud provider, while the organization controls guest OS configurations and access policies. Which concept BEST explains this division of responsibility?

An analyst needs an open-source tool to scan a multi-cloud environment for misconfigurations and generate a detailed security report. The organization uses AWS and Azure. Which tool is the BEST choice?

A Prowler scan of an AWS environment reveals multiple failed checks related to overly permissive IAM roles and publicly accessible S3 buckets. No active exploitation is detected. What should the analyst do FIRST?

During a security review, an investigator finds that attackers are using PowerShell to download and execute scripts from external sources. Which feature of PowerShell MOST enables attackers to automate such malicious activities?

A cybersecurity analyst needs to identify potential data exfiltration attempts by scanning log files for unknown patterns, such as credit card numbers or encoded payloads, where the exact values are not known in advance. Which scripting feature would be MOST effective for this task?

A security analyst notices a Linux server making repeated outbound connections to an unfamiliar IP address using curl to download and execute a shell script. What is the MOST appropriate initial response?

While monitoring network traffic, an analyst detects a workstation sending regular, small DNS queries to an external domain every minute, even when the user is offline. What is the MOST likely explanation for this behavior?

An analyst discovers a new process on a Windows endpoint named 'svchosts.exe' consuming excessive CPU resources. The legitimate 'svchost.exe' is also running. What should the analyst do FIRST to assess the risk?