An organization is migrating to a zero trust architecture. Which implementation BEST aligns with zero trust principles?

An analyst is validating whether a suspicious email was spoofed. Which TWO controls MOST directly verify sender authenticity?

Which tool provides the BEST method to safely observe runtime behavior of a suspicious executable?

Which host-based indicator MOST strongly suggests malware persistence?

Which threat actor is MOST likely to use long-term stealth, custom tooling, and supply-chain compromise?

Which source represents closed-source threat intelligence?

Which scripting language is MOST effective for automating Windows security response actions?

Integrating SIEM, EDR, and threat-intel platforms into a unified dashboard BEST demonstrates:

Which SOAR capability MOST reduces analyst fatigue during high alert volumes?

Which scanning method provides the MOST comprehensive vulnerability results?

A security team wants vulnerability insight without impacting production systems. What is the BEST approach?

A vulnerability has a low attack complexity and requires no privileges. What does this MOST strongly indicate?

Which vulnerability allows attackers to execute database commands via unsanitized input?

A Web Application Firewall (WAF) is classified as which control type?

Which risk response strategy involves acknowledging risk without remediation?

Which tool BEST assesses misconfigurations in AWS environments?

Which practice focuses on identifying and reducing externally exposed assets?

Which secure coding practice MOST effectively prevents SQL injection?

Which vulnerability tricks a server into making unauthorized internal requests?

Which framework maps adversary tactics, techniques, and procedures?

What ensures evidence integrity during incident investigations?

Isolating infected systems occurs during which IR phase?

Which post-incident activity determines WHY the incident occurred?

Which activity MOST improves organizational readiness for future incidents?

Which metric measures how quickly incidents are identified?

Which report section is MOST appropriate for executive leadership?

Which factor MOST commonly delays remediation efforts?

Who MUST be involved when an incident may require public disclosure?

Which metric BEST helps assess SOC workload trends?