Your FREE CompTIA CySA+ (Cybersecurity Analyst) Practice Test 2026 – 180+ Q&A

CySA+ Practice Questions

1. In the context of cybersecurity, which technique is used in an IDS to detect threats based on known attack patterns?
   • Weighing traffic against learned probabilistic baselines
   • Scoring traffic against adjustable behavioral heuristics
   • Matching traffic against catalogued malicious signatures
   • Checking traffic against standardized protocol semantics

   Correct answer: Matching traffic against catalogued malicious signatures

   Correct answer: Matching traffic against catalogued malicious signatures. Signature-based detection is the IDS technique built on known attack patterns: the sensor holds a catalog of byte sequences, packet structures and command strings already observed in real attacks and alerts when live traffic matches one. Weighing traffic against learned probabilistic baselines is anomaly-based detection, which reports statistical deviation from what the network normally does and therefore needs no known pattern at all. Scoring traffic against adjustable behavioral heuristics is heuristic analysis, which reasons about suspicious characteristics rather than matching a recorded attack. Checking traffic against standardized protocol semantics is stateful protocol analysis, which compares traffic to how a protocol is defined to behave, not to a library of attacks.

2. What is the primary purpose of a honeypot in network security?
   • Attracting attackers onto an instrumented decoy asset
   • Blocking attackers at the segmented network firewalls
   • Screening attackers from the inbound message channels
   • Discarding attackers' packets at the routing boundary

   Correct answer: Attracting attackers onto an instrumented decoy asset

   Correct answer: Attracting attackers onto an instrumented decoy asset. A honeypot is a deliberately exposed, heavily instrumented system with no production role, so every interaction with it is unauthorized by definition. Its value is that it draws adversaries away from real assets while recording their tooling and technique. Blocking attackers at the segmented network firewalls is enforcement rather than deception; a firewall denies the connection instead of inviting and observing it. Screening attackers from the inbound message channels describes a secure email or web gateway, which filters content and never presents a false target. Discarding attackers' packets at the routing boundary is remotely triggered blackholing, which silently drops traffic and deliberately gathers nothing about the adversary.

3. In threat intelligence, what is the primary objective of indicator of compromise IoC analysis?
   • Forecasting which adversaries will target the finance sector next
   • Estimating the regulatory expense that a confirmed breach creates
   • Ranking which vendor patches deserve the earliest possible action
   • Identifying endpoints that show artifacts of an ongoing intrusion

   Correct answer: Identifying endpoints that show artifacts of an ongoing intrusion

   Correct answer: Identifying endpoints that show artifacts of an ongoing intrusion. Indicators of compromise are forensic artifacts left behind by intrusion activity, such as malicious file hashes, beaconing destinations, registry changes and anomalous log entries. Analysts match them against telemetry to answer one question: has this environment already been breached. Forecasting which adversaries will target the finance sector next is strategic threat intelligence, which reasons about future intent rather than present evidence. Estimating the regulatory expense that a confirmed breach creates is business impact analysis, a financial exercise that only begins once detection has happened. Ranking which vendor patches deserve the earliest possible action is vulnerability remediation planning, which addresses exposure that has not yet been exploited.

4. Which type of attack involves overwhelming a target with traffic to make it inaccessible?
   • Credential phishing that tricks employees into surrendering their passwords
   • Distributed flooding that exhausts the victim's available network bandwidth
   • Query tampering that rewrites the application's backing database statements
   • Malicious scripting that executes inside the unsuspecting visitor's browser

   Correct answer: Distributed flooding that exhausts the victim's available network bandwidth

   Correct answer: Distributed flooding that exhausts the victim's available network bandwidth. A distributed denial-of-service attack directs traffic from many compromised sources at one target until bandwidth, connection state or application capacity is consumed and legitimate users can no longer be served. Credential phishing that tricks employees into surrendering their passwords steals authentication material through deception, and the service itself stays fully reachable. Query tampering that rewrites the application's backing database statements is SQL injection, an attack on confidentiality and integrity rather than availability. Malicious scripting that executes inside the unsuspecting visitor's browser is cross-site scripting, which runs code on the client side and likewise leaves the service online.

5. What is the primary purpose of a Security Information and Event Management (SIEM) system?
   • Removing malicious executables discovered on centrally managed endpoints
   • Correlating logged telemetry collected from numerous independent systems
   • Restricting privileged rights granted to administrative service accounts
   • Detecting unpatched software reported by scheduled credentialed scanning

   Correct answer: Correlating logged telemetry collected from numerous independent systems

   Correct answer: Correlating logged telemetry collected from numerous independent systems. A SIEM ingests events from firewalls, servers, applications and identity platforms, normalizes them into a common schema and correlates across those sources, so activity that means nothing in one log becomes an alert when seen beside another. Removing malicious executables discovered on centrally managed endpoints is endpoint protection or EDR work; a SIEM analyzes records and does not clean hosts. Restricting privileged rights granted to administrative service accounts is privileged access management, a preventive identity control rather than an analytic one. Detecting unpatched software reported by scheduled credentialed scanning belongs to the vulnerability scanner, which measures exposure instead of correlating live events.

6. Which cybersecurity framework focuses on improving the cyber resilience of critical infrastructure?
   • The ISO standard, aimed at management system certification
   • The COBIT model, aimed at enterprise technology governance
   • The OWASP project, aimed at website application weaknesses
   • The NIST guidance, aimed at operational exposure reduction

   Correct answer: The NIST guidance, aimed at operational exposure reduction

   Correct answer: The NIST guidance, aimed at operational exposure reduction. The NIST Cybersecurity Framework was commissioned specifically to raise the cyber resilience of critical infrastructure operators, and its core functions give owners and regulators a shared risk language for exactly that purpose. The ISO standard, aimed at management system certification, is ISO/IEC 27001, an auditable specification for an information security management system that any organization may certify against, with no infrastructure focus. The COBIT model, aimed at enterprise technology governance, addresses the governance of information technology as a whole rather than cyber resilience. The OWASP project, aimed at website application weaknesses, is a community effort concerned with application-layer software defects.

7. In cybersecurity, what is the main purpose of threat hunting?
   • Proactively seeking intruders missed by existing detection alerts
   • Systematically containing intruders after one alert has triggered
   • Safely simulating intruders under an approved engagement contract
   • Routinely ranking system weaknesses intruders could exploit later

   Correct answer: Proactively seeking intruders missed by existing detection alerts

   Correct answer: Proactively seeking intruders missed by existing detection alerts. Threat hunting starts from the assumption that an adversary is already inside and that automated controls have not fired; the hunter forms a hypothesis and searches telemetry for the activity that would confirm it. Systematically containing intruders after one alert has triggered is incident response, which is reactive by definition and begins from a detection that already exists. Safely simulating intruders under an approved engagement contract is penetration testing or red teaming, which emulates an adversary instead of looking for a real one. Routinely ranking system weaknesses intruders could exploit later is vulnerability management, which measures unexploited exposure rather than searching for a live intrusion.

8. Which attack method involves injecting malicious scripts into web pages viewed by users?
   • Query injection in loosely validated database statements
   • Command injection in poorly filtered process invocations
   • Script injection in dynamically rendered browser content
   • Header injection in improperly cached upstream responses

   Correct answer: Script injection in dynamically rendered browser content

   Correct answer: Script injection in dynamically rendered browser content. Cross-site scripting places attacker-controlled script into output that a web application returns to other users, so the code runs in each victim's browser with the trust of the visited site. Query injection in loosely validated database statements is SQL injection, which executes on the database server rather than in a user's browser. Command injection in poorly filtered process invocations executes on the underlying host operating system, not in the page. Header injection in improperly cached upstream responses is response splitting or cache poisoning, which manipulates the HTTP response envelope rather than planting script inside rendered page content.

9. What is the primary function of file integrity monitoring (FIM) in cybersecurity?
   • Alerting when signatures match a freshly downloaded binary
   • Alerting when logins exceed the accepted lockout threshold
   • Alerting when regulated records leave the network boundary
   • Alerting when a guarded system object changes unexpectedly

   Correct answer: Alerting when a guarded system object changes unexpectedly

   Correct answer: Alerting when a guarded system object changes unexpectedly. File integrity monitoring takes a cryptographic baseline of critical binaries, configuration files, registry keys and system directories, then reports any deviation from it, because unexplained modification is a reliable sign of tampering, malware persistence or unauthorized administration. Alerting when signatures match a freshly downloaded binary is antimalware scanning, which recognizes known bad content rather than measuring change. Alerting when logins exceed the accepted lockout threshold is an authentication control aimed at credential guessing, not at file state. Alerting when regulated records leave the network boundary is data loss prevention, which watches data in motion rather than the integrity of files at rest.

10. In the context of cybersecurity, what is 'credential stuffing'?
    • Automated testing of popular passwords against many different accounts
    • Automated brute-force of alphanumeric strings against a specific login
    • Automated replay of breached username pairs against unrelated websites
    • Automated lookup of captured hashes against precomputed rainbow tables

    Correct answer: Automated replay of breached username pairs against unrelated websites

    Correct answer: Automated replay of breached username pairs against unrelated websites. Credential stuffing feeds username and password pairs recovered from an earlier breach into login forms at other services, betting on password reuse; the attacker never guesses, they replay known-good pairs. Automated testing of popular passwords against many different accounts is password spraying, which tries a small set of likely passwords broadly to stay under lockout thresholds. Automated brute-force of alphanumeric strings against a specific login exhausts a keyspace instead of reusing stolen pairs. Automated lookup of captured hashes against precomputed rainbow tables is offline hash cracking, which needs stolen hashes and never touches the login form.

11. What technique is commonly used in cyber threat intelligence for correlating large sets of data to identify potential threats?
    • Data normalization that aligns mismatched log formats between vendors
    • Data mining that surfaces recurring patterns inside enormous datasets
    • Data masking that suppresses regulated customer fields from operators
    • Data retention that preserves archived incident evidence across years

    Correct answer: Data mining that surfaces recurring patterns inside enormous datasets

    Correct answer: Data mining that surfaces recurring patterns inside enormous datasets. Correlating very large volumes of telemetry to expose relationships no analyst would find by inspection is exactly what data mining contributes to cyber threat intelligence, and it is how clusters of related indicators and repeated adversary behavior are discovered. Data normalization that aligns mismatched log formats between vendors is a preparation step that makes records comparable but discovers nothing by itself. Data masking that suppresses regulated customer fields from operators is a privacy control applied to protect data rather than analyze it. Data retention that preserves archived incident evidence across years governs how long records are kept and performs no correlation.

12. In cybersecurity, what is the main purpose of using a sandbox environment?
    • Detonating unknown binaries inside a fully isolated instrumented container
    • Restoring compromised endpoints from a previously verified system snapshot
    • Segmenting corporate servers onto separately routed and firewalled subnets
    • Signing internal applications with a trusted publisher release certificate

    Correct answer: Detonating unknown binaries inside a fully isolated instrumented container

    Correct answer: Detonating unknown binaries inside a fully isolated instrumented container. A sandbox runs a suspicious executable in a contained, monitored space so its behavior, network callbacks and file changes can be observed with no risk to production systems. Restoring compromised endpoints from a previously verified system snapshot is recovery after an incident; it destroys the sample instead of studying it. Segmenting corporate servers onto separately routed and firewalled subnets is network segmentation, a preventive architecture control that limits lateral movement but performs no analysis. Signing internal applications with a trusted publisher release certificate is code signing, which asserts the origin and integrity of software the organization produced itself.

13. Which method is most effective for detecting zero-day exploits?
    • Behavioral analysis measured against a learned traffic baseline
    • Signature matching measured against a published malware catalog
    • Hash comparison measured against a circulated malware blocklist
    • Version checking measured against a vendor maintained inventory

    Correct answer: Behavioral analysis measured against a learned traffic baseline

    Correct answer: Behavioral analysis measured against a learned traffic baseline. A zero-day exploit has no published indicator, so the only approach with a realistic chance of catching it is one that models normal activity and reports departures from it, such as unusual process lineage, unexpected outbound destinations or abnormal volumes. Signature matching measured against a published malware catalog can only recognize what has already been documented, which a zero-day by definition has not. Hash comparison measured against a circulated malware blocklist has the same limitation and fails the moment a sample is recompiled. Version checking measured against a vendor maintained inventory reports missing fixes, and for a zero-day no fix yet exists to be missing.

14. What is the primary goal of a DDoS (Distributed Denial of Service) attack?
    • To exfiltrate stored client files and resell them onward
    • To exhaust capacity and deny the legitimate users access
    • To encrypt stored volumes and demand a decryption ransom
    • To escalate account rights and persist inside the domain

    Correct answer: To exhaust capacity and deny the legitimate users access

    Correct answer: To exhaust capacity and deny the legitimate users access. A distributed denial-of-service attack targets the availability leg of the security triad: bandwidth, connection state or application capacity is consumed until real users are turned away, and the attacker takes nothing else from it. To exfiltrate stored client files and resell them onward is a confidentiality attack, and a noisy flood would only make quiet theft harder. To encrypt stored volumes and demand a decryption ransom is ransomware, which needs continued access to the data it holds hostage. To escalate account rights and persist inside the domain describes an intrusion seeking control, which flooding does not deliver.

15. In threat management, what is the primary function of a SIEM (Security Information and Event Management) system?
    • Removing malicious executables from infected staff workstations
    • Blocking forbidden web destinations from corporate workstations
    • Reporting correlated incident signals to responders immediately
    • Restricting database privileges to authorized service processes

    Correct answer: Reporting correlated incident signals to responders immediately

    Correct answer: Reporting correlated incident signals to responders immediately. In threat management the SIEM is the analytic and reporting layer: it correlates events arriving from many devices and surfaces them as prioritized alerts, dashboards and reports so responders can act while the activity is still live. Removing malicious executables from infected staff workstations is endpoint remediation performed by antimalware or EDR agents. Blocking forbidden web destinations from corporate workstations is content filtering carried out by a proxy or secure web gateway. Restricting database privileges to authorized service processes is access control administered inside the database. All three enforce policy; none of them reports correlated activity to an analyst.

16. Which type of cyber attack involves manipulating a user into disclosing confidential information or performing actions?
    • Rootkit loading that conceals attacker processes from the user
    • Hash replay that reuses a user's captured authentication token
    • Ticket cracking that exposes a user's service account password
    • Deceptive messaging that persuades a user to surrender secrets

    Correct answer: Deceptive messaging that persuades a user to surrender secrets

    Correct answer: Deceptive messaging that persuades a user to surrender secrets. Phishing is social engineering delivered as a message impersonating a trusted party so the recipient hands over credentials or performs an action such as approving a payment or opening an attachment; the person is the exploited component. Rootkit loading that conceals attacker processes from the user is a persistence and stealth technique applied after access is already obtained. Hash replay that reuses a user's captured authentication token is pass-the-hash, which reuses stolen material with no interaction from the account holder. Ticket cracking that exposes a user's service account password is Kerberoasting, an offline attack on service ticket encryption the user never sees.

17. What is the primary focus of behavioral analytics in cybersecurity?
    • Cataloging software assets and flagging unlicensed application installs
    • Reviewing firewall rulesets and flagging outdated permissive exceptions
    • Baselining user activity and flagging unusual authentication deviations
    • Classifying stored documents and flagging regulated private identifiers

    Correct answer: Baselining user activity and flagging unusual authentication deviations

    Correct answer: Baselining user activity and flagging unusual authentication deviations. Behavioral analytics, usually sold as user and entity behavior analytics, builds a statistical profile of how each account and device normally acts and reports departures from it, which is how insider misuse and stolen-credential abuse are caught when no signature exists. Cataloging software assets and flagging unlicensed application installs is asset and license management, which inventories software rather than modeling conduct. Reviewing firewall rulesets and flagging outdated permissive exceptions is rule hygiene aimed at configuration, not at people. Classifying stored documents and flagging regulated private identifiers is data classification, which labels information at rest and never observes activity.

18. Which cybersecurity tool is primarily used for deep packet inspection of network traffic?
    • NetFlow collectors that record summarized session flow metadata
    • Physical taps that mirror traffic towards monitoring appliances
    • SIEM platforms that index forwarded application event summaries
    • Intrusion detection sensors that inspect entire packet payloads

    Correct answer: Intrusion detection sensors that inspect entire packet payloads

    Correct answer: Intrusion detection sensors that inspect entire packet payloads. Deep packet inspection means opening the payload rather than reading only addressing information, and that is precisely what an IDS sensor does when it matches signatures and protocol behavior against the contents of traffic. NetFlow collectors that record summarized session flow metadata deliberately keep only header-derived facts such as addresses, ports, byte counts and timestamps, never the payload itself. Physical taps that mirror traffic towards monitoring appliances duplicate packets at the physical layer and perform no inspection of their own. SIEM platforms that index forwarded application event summaries analyze logs produced elsewhere and never see the packets.

19. In the context of threat intelligence, what is the main purpose of STIX (Structured Threat Information eXpression)?
    • Transporting threat reports among federated intelligence sharing peer servers
    • Expressing threat activity in one standard machine-readable structured format
    • Scoring threat exploitability using a standardized industry numerical formula
    • Cataloging threat-related software defects under one public labeling registry

    Correct answer: Expressing threat activity in one standard machine-readable structured format

    Correct answer: Expressing threat activity in one standard machine-readable structured format. STIX is a modeling language: it defines objects and relationships for actors, campaigns, malware, indicators and observed data so intelligence written by one organization can be parsed unchanged by another organization's tooling. Transporting threat reports among federated intelligence sharing peer servers is TAXII, the companion transport protocol that moves STIX content without defining it. Scoring threat exploitability using a standardized industry numerical formula is CVSS, which rates how serious a flaw is rather than describing threat activity. Cataloging threat-related software defects under one public labeling registry is CVE, a naming scheme for individual vulnerabilities.

20. What is the role of a threat actor in the context of cybersecurity?
    • The individual or group that mounts a deliberate intrusion
    • The responder or team that neutralizes an unfolding breach
    • The vendor or lab that publishes advisory bulletins weekly
    • The assessor or firm that scores control maturity annually

    Correct answer: The individual or group that mounts a deliberate intrusion

    Correct answer: The individual or group that mounts a deliberate intrusion. A threat actor is the adversary itself, ranging from a lone criminal through organized crime, hacktivists and malicious insiders to state-sponsored teams; the term names who is acting against the organization, and analysts profile actors to anticipate capability and intent. The responder or team that neutralizes an unfolding breach is the defender, the opposite side of the engagement. The vendor or lab that publishes advisory bulletins weekly is an intelligence provider that reports on actors without ever being one. The assessor or firm that scores control maturity annually performs independent evaluation and holds no adversarial role at all.

21. Which of the following is a primary characteristic of Advanced Persistent Threats (APTs)?
    • Opportunistic automated scanning driven by generic commodity exploit kits
    • Prolonged stealthy occupation of a silently compromised enterprise estate
    • Immediate wholesale encryption followed by an advertised extortion demand
    • Loud volumetric flooding intended to exhaust available upstream bandwidth

    Correct answer: Prolonged stealthy occupation of a silently compromised enterprise estate

    Correct answer: Prolonged stealthy occupation of a silently compromised enterprise estate. An advanced persistent threat is defined by dwell time and discipline: a well-resourced adversary establishes footholds, moves quietly, maintains redundant access and collects intelligence over months or years while avoiding anything that would trigger investigation. Opportunistic automated scanning driven by generic commodity exploit kits describes untargeted mass exploitation, which takes whatever it finds and moves straight on. Immediate wholesale encryption followed by an advertised extortion demand announces itself deliberately, the opposite of persistence through stealth. Loud volumetric flooding intended to exhaust available upstream bandwidth is a denial-of-service campaign, short-lived, highly visible and seeking no long-term access.

22. In cybersecurity, what does the term 'chain of custody' refer to?
    • The cryptographic digest confirming an image matches its source
    • The volatility order guiding which artifact gets captured first
    • The written record tracking each transfer of collected evidence
    • The legal authorization permitting a lawful search of equipment

    Correct answer: The written record tracking each transfer of collected evidence

    Correct answer: The written record tracking each transfer of collected evidence. Chain of custody is the continuous documentation showing who seized an item, who held it, when every handover occurred and how it was stored, from collection through to presentation; a gap in that record lets opposing counsel argue the evidence could have been altered. The cryptographic digest confirming an image matches its source is integrity verification, which shows data is unchanged but says nothing about who possessed it. The volatility order guiding which artifact gets captured first is the order of volatility, a collection sequencing rule. The legal authorization permitting a lawful search of equipment is the warrant or consent that makes collection lawful.

23. What is the primary purpose of a vulnerability scanner in cybersecurity?
    • Enumerating known weaknesses on hosts and their loaded applications
    • Recording packet flows on routers and intermediate network switches
    • Blocking exploit attempts on servers and managed staff workstations
    • Encrypting archived records on databases and offline backup volumes

    Correct answer: Enumerating known weaknesses on hosts and their loaded applications

    Correct answer: Enumerating known weaknesses on hosts and their loaded applications. A vulnerability scanner compares what it finds on a target, including software versions, patch levels, open services and configuration settings, against a maintained database of known flaws, then reports the exposures for prioritization and remediation. Recording packet flows on routers and intermediate network switches is flow collection used for traffic visibility, which reveals communication patterns rather than weaknesses. Blocking exploit attempts on servers and managed staff workstations is prevention by an IPS or endpoint agent, acting against attacks in progress instead of cataloging exposure. Encrypting archived records on databases and offline backup volumes protects confidentiality and identifies no flaw at all.

24. Which attack involves intercepting and altering communications between two parties without their knowledge?
    • Watering-hole attacks seeding malware onto routinely trusted websites
    • Password-spraying attacks testing popular logins across many accounts
    • Supply-chain attacks tampering with trusted vendor software downloads
    • Man-in-the-middle attacks silently relaying one host's traffic onward

    Correct answer: Man-in-the-middle attacks silently relaying one host's traffic onward

    Correct answer: Man-in-the-middle attacks silently relaying one host's traffic onward. Also called an on-path attack, this places the adversary inside the communication path, so each side believes it is talking directly to the other while the attacker reads, and can alter, everything that passes through. Watering-hole attacks seeding malware onto routinely trusted websites compromise a site the victims already visit and wait for them to arrive; no live conversation is intercepted. Password-spraying attacks testing popular logins across many accounts guess credentials at the authentication surface. Supply-chain attacks tampering with trusted vendor software downloads corrupt code before delivery, subverting trust in the supplier rather than altering anything in flight.

25. In threat management, what is the function of a 'sinkhole' in terms of network security?
    • Rate-limiting harmful traffic toward a protected origin service
    • Mirroring harmful traffic toward a passive inspection appliance
    • Tarpitting harmful traffic toward a deliberately slowed session
    • Redirecting harmful traffic toward a controlled analysis server

    Correct answer: Redirecting harmful traffic toward a controlled analysis server

    Correct answer: Redirecting harmful traffic toward a controlled analysis server. A sinkhole answers requests for known malicious destinations with an address the defender owns, so traffic that would have reached attacker infrastructure is steered off the network and into a system that logs and studies it. Rate-limiting harmful traffic toward a protected origin service throttles volume while still delivering the connections to their intended destination. Mirroring harmful traffic toward a passive inspection appliance copies packets for analysis while the originals continue on their way, so nothing is diverted. Tarpitting harmful traffic toward a deliberately slowed session delays a sender to waste its time, again without changing where the traffic is bound.

26. Which cybersecurity principle involves the use of multiple layers of security controls and defenses?
    • Defense in depth, layering redundant safeguards behind one another
    • Least privilege, granting the minimum rights an operation requires
    • Separation of duties, splitting a sensitive process between people
    • Zero trust, verifying each request before allowing session traffic

    Correct answer: Defense in depth, layering redundant safeguards behind one another

    Correct answer: Defense in depth, layering redundant safeguards behind one another. The principle assumes any single control will eventually fail or be bypassed, so overlapping and independent measures are stacked across the network, host, application and data tiers and an attacker must defeat all of them in sequence. Least privilege, granting the minimum rights an operation requires, is a single access principle that limits blast radius but supplies no redundancy. Separation of duties, splitting a sensitive process between people, stops one person completing a harmful action alone and is administrative rather than layered. Zero trust, verifying each request before allowing session traffic, removes implicit trust from the network and is an architectural model, not a stack of layers.

27. In cybersecurity, what is the primary purpose of conducting a vulnerability scan?
    • To detect current intrusions and active beaconing callbacks
    • To collect volatile evidence and protect forensic artifacts
    • To reveal unpatched software and weak server configurations
    • To enforce access policies and reject unauthorized sessions

    Correct answer: To reveal unpatched software and weak server configurations

    Correct answer: To reveal unpatched software and weak server configurations. A vulnerability scan is a proactive assessment: it probes systems and applications for missing updates, default or weak settings, unnecessary exposed services and other documented flaws, then produces a prioritized list of exposures to fix before an attacker reaches them. To detect current intrusions and active beaconing callbacks is the role of intrusion detection and network monitoring, which react to activity already under way. To collect volatile evidence and protect forensic artifacts is digital forensics, which starts only after an incident is confirmed. To enforce access policies and reject unauthorized sessions is preventive access control, stopping connections rather than measuring exposure.

28. Which technique is used in cybersecurity to disguise and hide data in plain sight, typically within another file or data stream?
    • Tokenization, substituting a surrogate value for a stored identifier
    • Steganography, embedding a hidden payload inside a harmless document
    • Obfuscation, rewriting program logic so it resists casual inspection
    • Encryption, transforming readable text into an unreadable coded form

    Correct answer: Steganography, embedding a hidden payload inside a harmless document

    Correct answer: Steganography, embedding a hidden payload inside a harmless document. Steganography conceals the very existence of a message by hiding it inside ordinary-looking media such as an image, audio track or document, so an observer sees only the carrier and has no reason to suspect anything is present. Tokenization, substituting a surrogate value for a stored identifier, swaps sensitive data for a meaningless reference that is openly visible as a placeholder. Obfuscation, rewriting program logic so it resists casual inspection, makes code hard to follow but leaves it plainly present. Encryption, transforming readable text into an unreadable coded form, hides the content of a message while advertising that a protected message exists.

29. What is the main function of a Security Operations Center (SOC.) in an organization?
    • Watching enterprise telemetry and triaging credible intrusion incidents
    • Drafting enterprise policy and publishing detailed governance standards
    • Teaching enterprise employees and testing their phishing susceptibility
    • Auditing enterprise suppliers and rating third-party risk concentration

    Correct answer: Watching enterprise telemetry and triaging credible intrusion incidents

    Correct answer: Watching enterprise telemetry and triaging credible intrusion incidents. A security operations center is the standing team that monitors the organization's security posture around the clock, triaging alerts from the SIEM and other sensors, establishing what is real and driving the response through containment and recovery. Drafting enterprise policy and publishing detailed governance standards belongs to the governance, risk and compliance function, which sets direction rather than watching live telemetry. Teaching enterprise employees and testing their phishing susceptibility is the awareness program, a preventive education activity. Auditing enterprise suppliers and rating third-party risk concentration is supplier risk management, an assurance function performed outside continuous monitoring.

30. Which of the following vulnerability scanning techniques is LEAST likely to be detected by intrusion detection systems?
    • Credentialed scanning, authenticating remotely onto each targeted system
    • Non-credentialed scanning, probing exposed services from public networks
    • Passive scanning, interpreting traffic silently duplicated onto monitors
    • Active scanning, transmitting crafted packets towards identified targets

    Correct answer: Passive scanning, interpreting traffic silently duplicated onto monitors

    Correct answer: Passive scanning, interpreting traffic silently duplicated onto monitors. A passive scanner infers software versions and weaknesses from traffic copied to it by a span port or network tap, so it generates no packets of its own and leaves an intrusion detection system nothing to notice. Credentialed scanning, authenticating remotely onto each targeted system, logs in and queries the host, producing authentication events and local activity that are readily logged. Non-credentialed scanning, probing exposed services from public networks, still sends live requests to open ports and trips the same signatures. Active scanning, transmitting crafted packets towards identified targets, is the noisiest of all and is exactly the behavior detection rules are written to catch.

31. In vulnerability management, what is the main purpose of a "false negative" result?
    • It escalates a harmless finding that no exposure substantiates
    • It reports a passing scan while exploitable weaknesses persist
    • It confirms a protected host after exhaustive probing succeeds
    • It validates a genuine finding that matching evidence supports

    Correct answer: It reports a passing scan while exploitable weaknesses persist

    Correct answer: It reports a passing scan while exploitable weaknesses persist. A false negative is a miss: the test returns a clean result although a genuine, exploitable flaw is present, and because the output looks healthy the exposure is never queued for remediation. That is the outcome analysts fear most, which is why scan results are validated against a second source. It escalates a harmless finding that no exposure substantiates describes a false positive, which wastes triage effort but hides no risk. It confirms a protected host after exhaustive probing succeeds is a true negative, an accurate clean result. It validates a genuine finding that matching evidence supports is a true positive, an accurate detection of a real flaw.

32. Which of the following best describes the role of fuzzing in vulnerability management?
    • Comparing running builds against patch baselines
    • Submitting malformed inputs until programs crash
    • Auditing host settings against policy statements
    • Mapping trust zones between partitioned segments

    Correct answer: Submitting malformed inputs until programs crash

    Correct answer: Submitting malformed inputs until programs crash. Explanation: Fuzzing drives a target with malformed, unexpected or random input and watches for the crashes, hangs and memory faults that expose unhandled code paths, which is why it finds defects no signature-driven check would reach. Comparing running builds against patch baselines is patch-level auditing: it reports missing updates and never exercises the code. Auditing host settings against policy statements is configuration compliance checking, which measures documented state rather than runtime behavior. Mapping trust zones between partitioned segments is a segmentation review, an architecture task that says nothing about how an application handles input.

33. In the context of vulnerability scanning, what does the term "pivot" refer to?
    • Rotating stored scanner logins between audit windows
    • Raising administrator privileges on a trusted server
    • Switching scan profiles midway through an assessment
    • Relaying traffic through an already compromised host

    Correct answer: Relaying traffic through an already compromised host

    Correct answer: Relaying traffic through an already compromised host. Explanation: Pivoting means routing further reconnaissance and attack traffic through a machine the attacker already controls, so internal systems that were never exposed to the attacker directly become reachable through the foothold. Rotating stored scanner logins between audit windows is credential hygiene for the assessment platform and involves no attacker movement at all. Raising administrator privileges on a trusted server is privilege escalation, which increases rights on one host rather than extending reach to another. Switching scan profiles midway through an assessment is retuning the scan, not using a foothold as a relay.

34. What is a primary concern when conducting authenticated vulnerability scans?
    • Intrusive probes destabilizing the scanned server
    • Signature feeds trailing behind vendor advisories
    • Scanner findings duplicating the stored inventory
    • Firewall policies blocking outbound probe traffic

    Correct answer: Intrusive probes destabilizing the scanned server

    Correct answer: Intrusive probes destabilizing the scanned server. Explanation: A credentialed scan logs in and runs far deeper checks than an external sweep, enumerating services, reading local configuration and exercising interfaces the network never exposes, so the leading operational risk is that a fragile service or host becomes unstable while the scan runs. Signature feeds trailing behind vendor advisories degrades every scan equally, credentialed or not, so it is not what changes when credentials are supplied. Scanner findings duplicating the stored inventory is an asset-management annoyance and poses no risk to the target. Firewall policies blocking outbound probe traffic describes an obstacle to unauthenticated external scanning, which local credentialed checks largely bypass.

35. Which term best describes a situation where a vulnerability scanner incorrectly identifies a secure system as vulnerable?
    • True positive scan outcome
    • False negative scan report
    • False positive scan result
    • True negative scan finding

    Correct answer: False positive scan result

    Correct answer: False positive scan result. Explanation: A false positive is a finding the scanner raises against a system that is not actually vulnerable, so effort is spent chasing a condition that does not exist and confidence in the tool erodes. False negative scan report names the opposite failure, a real weakness the scanner missed entirely. True positive scan outcome names a finding that is both raised and real, which cannot describe a system the stem tells us is secure. True negative scan finding names a healthy system correctly left unflagged, and here the scanner did flag it.

36. In vulnerability management, what is the significance of CVSS scoring?
    • Estimating probable losses for insurance cover
    • Confirming exploit code in public repositories
    • Ranking remediation tasks by measured severity
    • Measuring control coverage against a framework

    Correct answer: Ranking remediation tasks by measured severity

    Correct answer: Ranking remediation tasks by measured severity. Explanation: CVSS converts a vulnerability's characteristics into a repeatable severity score, and the value of that score to a program is that it lets a team order a backlog it can never clear all at once. Estimating probable losses for insurance cover is quantitative risk analysis expressed in money, and CVSS deliberately carries no financial units. Confirming exploit code in public repositories is exploit intelligence, a separate input that a severity score does not establish. Measuring control coverage against a framework is a control assessment, which scores defenses rather than the flaws themselves.

37. Which vulnerability assessment technique involves examining the system from within to simulate an attack by a malicious insider?
    • White box testing engagements
    • Black box testing engagements
    • Gray box testing walkthroughs
    • Red team adversary emulations

    Correct answer: White box testing engagements

    Correct answer: White box testing engagements. Explanation: A white box engagement hands the tester full internal information, including source, architecture, configuration and credentials, which is exactly the position a trusted insider already occupies, so it is the technique that reproduces insider abuse. Black box testing engagements withhold that information and model an outsider working blind. Gray box testing walkthroughs share only partial detail, so they reproduce neither the insider's full visibility nor the outsider's blindness. Red team adversary emulations measure whether defenders detect and respond to a goal-driven attack, so their product is a picture of the response rather than an exhaustive internal review.

38. When a vulnerability scanner reports a vulnerability due to outdated software, but the software is actually up to date, this is an example of:
    • True positive signal
    • False negative claim
    • True negative status
    • False positive alert

    Correct answer: False positive alert

    Correct answer: False positive alert. Explanation: The scanner asserted a condition, out-of-date software, that verification shows is not present on the host, so an alarm was raised where no real weakness exists. True positive signal would require the package actually to be back-level, and it is current. False negative claim describes the reverse error, where a genuinely stale package goes unreported. True negative status would mean the scanner stayed silent about a healthy host, but silence is not what happened here.

39. What is the primary benefit of using automated vulnerability scanning tools in an organization?
    • Proving exploitability of a published host weakness
    • Repeating thorough checks with little manual effort
    • Blocking live exploitation aimed at unpatched hosts
    • Producing tamper evident records for legal disputes

    Correct answer: Repeating thorough checks with little manual effort

    Correct answer: Repeating thorough checks with little manual effort. Explanation: The payoff of automation is coverage per unit of analyst time: a tool re-runs the same broad checkset across the whole estate on a schedule, which no team could match by hand at that cadence or cost. Proving exploitability of a published host weakness is what a manual penetration test delivers, since a scanner infers the condition and stops short of demonstrating it. Blocking live exploitation aimed at unpatched hosts is preventive enforcement by an inline control, and a scanner has no blocking role. Producing tamper evident records for legal disputes is a forensic evidence-handling function that scan output was never designed to satisfy.

40. Which of the following best describes the purpose of a penetration test in the context of vulnerability management?
    • Emulating a real adversary to prove exploitability
    • Reviewing written policy against a control catalog
    • Monitoring internal traffic for signs of intrusion
    • Inspecting badge readers at data center perimeters

    Correct answer: Emulating a real adversary to prove exploitability

    Correct answer: Emulating a real adversary to prove exploitability. Explanation: A penetration test moves past the theoretical finding and actually exercises the weakness, so the organization learns which exposures a capable attacker can convert into access and how far that access reaches. Reviewing written policy against a control catalog is a documentation audit that never touches a live system. Monitoring internal traffic for signs of intrusion is detective network monitoring, which observes attacks rather than staging one. Inspecting badge readers at data center perimeters assesses physical entry control, a separate discipline from testing an exposed technical weakness.

41. In vulnerability management, what is the primary role of a patch management system?
    • Correlating alerts from many monitoring sensors
    • Blocking known malicious executables at runtime
    • Scheduling vendor updates for managed endpoints
    • Recording which accounts opened sensitive files

    Correct answer: Scheduling vendor updates for managed endpoints

    Correct answer: Scheduling vendor updates for managed endpoints. Explanation: A patch management system inventories what is installed, obtains vendor updates, sequences their release into test and production rings, and reports what remains outstanding, so remediation happens consistently instead of host by host. Correlating alerts from many monitoring sensors is event management performed by a SIEM. Blocking known malicious executables at runtime is endpoint protection, which stops code from running rather than closing the underlying defect. Recording which accounts opened sensitive files is access auditing, which produces a trail and never applies a fix.

42. Which vulnerability assessment methodology focuses on the security of third-party components within a system?
    • Static application code analysis
    • Open source composition analysis
    • Dynamic runtime traffic analysis
    • External network banner analysis

    Correct answer: Open source composition analysis

    Correct answer: Open source composition analysis. Explanation: Composition analysis inventories the third-party and open-source packages an application pulls in, resolves their transitive dependencies, and matches each one against published advisories, so it is the method aimed squarely at code the team did not write. Static application code analysis inspects the organization's own source for insecure patterns and generally ignores what arrives from a package manager. Dynamic runtime traffic analysis exercises the deployed application from outside and cannot attribute a fault to a particular library version. External network banner analysis identifies exposed service versions at the network edge, which reveals nothing about libraries linked into an application.

43. In the context of vulnerability management, what is the main objective of threat modeling?
    • Recording configuration drift from a hardened build
    • Tuning correlation rules to reduce duplicate alerts
    • Ranking servers by their audited purchase valuation
    • Predicting adversary moves against a planned design

    Correct answer: Predicting adversary moves against a planned design

    Correct answer: Predicting adversary moves against a planned design. Explanation: Threat modeling reasons about a system independently of any scan result: it names the plausible adversaries, walks the attack paths they would take through the design, and estimates what each would cost the business, so controls can be chosen before the system ships. Recording configuration drift from a hardened build is configuration management and reports what changed, not what an attacker would attempt. Tuning correlation rules to reduce duplicate alerts is detection engineering, carried out once telemetry already exists. Ranking servers by their audited purchase valuation is asset accounting, and replacement cost is not a measure of attacker interest.

44. Which of the following best defines a zero-day vulnerability?
    • A flaw previously eliminated by published updates
    • A flaw circulating quietly among criminal brokers
    • A flaw introduced through unsafe default settings
    • A flaw still lacking published vendor remediation

    Correct answer: A flaw still lacking published vendor remediation

    Correct answer: A flaw still lacking published vendor remediation. Explanation: A zero-day is defined by the absence of a fix, since the vendor has had no days to remediate it, so defenders have no patch to apply and must rely on mitigation, virtual patching and detection instead. A flaw previously eliminated by published updates is an n-day, the ordinary case where a fix exists and the exposure is a patching failure. A flaw circulating quietly among criminal brokers describes the exploit market and speaks to who holds tooling, not to whether a fix has shipped. A flaw introduced through unsafe default settings is a misconfiguration, corrected by changing the setting rather than by waiting on the vendor.

45. What is the primary benefit of continuous vulnerability scanning as compared to periodic scanning?
    • Proving that a reported weakness is exploitable
    • Finding new exposures that scheduled scans miss
    • Cutting licence fees that scanning vendors bill
    • Producing records that courts treat as evidence

    Correct answer: Finding new exposures that scheduled scans miss

    Correct answer: Finding new exposures that scheduled scans miss. Explanation: A calendar-driven sweep leaves a blind window, because anything introduced the day after one runs stays invisible until the next one comes round. Continuous assessment closes that window, so newly built hosts, restored images and freshly disclosed weaknesses surface while there is still time to act. Proving that a reported weakness is exploitable is validation work no scanner performs at any frequency. Cutting licence fees that scanning vendors bill runs the wrong way, since continuous coverage generally costs more rather than less. Producing records that courts treat as evidence is a forensic requirement with its own handling rules and is unrelated to scan cadence.

46. In vulnerability management, what is the primary purpose of a baseline configuration?
    • To restore lost records after a controller failure
    • To flag unusual outbound traffic from user subnets
    • To capture the approved settings for server builds
    • To scramble records kept on portable media devices

    Correct answer: To capture the approved settings for server builds

    Correct answer: To capture the approved settings for server builds. Explanation: A baseline is the documented secure state a system is built to and the reference every later audit compares against, which is what makes drift measurable and what gives a hardening standard something to enforce. To restore lost records after a controller failure is backup and recovery, which returns data rather than defining a standard. To flag unusual outbound traffic from user subnets is network monitoring, which reacts to observed behavior instead of prescribing state. To scramble records kept on portable media devices is media encryption, a data-protection control that leaves system settings untouched.

47. Which technology is primarily used to isolate applications in their own secure environment to prevent vulnerabilities from affecting other applications?
    • Container based workload isolation
    • Stateful firewall inspection rules
    • Encrypted corporate site tunneling
    • Signature matching file quarantine

    Correct answer: Container based workload isolation

    Correct answer: Container based workload isolation. Explanation: Containers give each workload its own namespaces, filesystem view and resource limits, so a compromise or a crash inside one stays within that boundary instead of reaching the workloads beside it on the same host. Stateful firewall inspection rules govern traffic between networks and do nothing about two processes sharing a kernel. Encrypted corporate site tunneling protects data crossing untrusted links and provides no runtime separation at the destination. Signature matching file quarantine removes recognized files after detection, so it depends on knowing the threat first and never confines an unknown one.

48. What is the role of a vulnerability feed in a vulnerability management program?
    • Delivering signed patches directly to managed hosts
    • Supplying current advisory data on known weaknesses
    • Streaming alerts about intrusions already under way
    • Logging privileged sessions for later abuse reviews

    Correct answer: Supplying current advisory data on known weaknesses

    Correct answer: Supplying current advisory data on known weaknesses. Explanation: A vulnerability feed is a subscription stream of advisory records, carrying identifiers, affected versions, severity and fix status, which keeps scanner checks and the analyst's picture of the landscape current. Delivering signed patches directly to managed hosts is distribution performed by a patch management system, and a feed carries descriptions rather than binaries. Streaming alerts about intrusions already under way is detection telemetry, which reports live activity instead of catalogued weaknesses. Logging privileged sessions for later abuse reviews is monitoring of insider activity and produces audit trails, not advisory content.

49. What is a primary consideration when performing vulnerability scans on production systems?
    • Throttling probes to protect busy customer workloads
    • Maintaining the scanner signature feed fully current
    • Storing finished reports inside an encrypted archive
    • Verifying asset owners before granting any exception

    Correct answer: Throttling probes to protect busy customer workloads

    Correct answer: Throttling probes to protect busy customer workloads. Explanation: Scanning consumes bandwidth, sockets and processor time on live systems, so on production the governing consideration is pacing, which means limiting concurrency, tuning intrusive checks and picking windows so revenue-bearing services do not degrade while the assessment runs. Maintaining the scanner signature feed fully current matters for every scan, in the laboratory as much as in production, so it does not describe what production changes. Storing finished reports inside an encrypted archive protects the output after the fact and has no bearing on the target's stability. Verifying asset owners before granting any exception belongs to the risk acceptance workflow that follows a finding.

50. What is the primary goal of implementing a Security Information and Event Management (SIEM) system in the context of vulnerability management?
    • To deploy approved updates across the entire estate
    • To terminate encrypted tunnels used by remote staff
    • To probe hosts for missing security update packages
    • To correlate logged events into ranked alert queues

    Correct answer: To correlate logged events into ranked alert queues

    Correct answer: To correlate logged events into ranked alert queues. Explanation: A SIEM ingests logs from across the estate, normalizes them into a common structure, and applies correlation rules so that related records become one ranked alert an analyst can work, which is what turns raw volume into something a team can triage while it still matters. To deploy approved updates across the entire estate is patch distribution and belongs to another platform entirely. To terminate encrypted tunnels used by remote staff is the role of a remote access gateway. To probe hosts for missing security update packages is what a vulnerability scanner does, and a SIEM consumes such findings rather than producing them.

51. In vulnerability management, what is the purpose of implementing a honeypot?
    • To hold offline copies of critical business archives
    • To strip harmful attachments from inbound mail flows
    • To lure network intruders onto an instrumented decoy
    • To hide internal addresses behind a mapped perimeter

    Correct answer: To lure network intruders onto an instrumented decoy

    Correct answer: To lure network intruders onto an instrumented decoy. Explanation: A honeypot is a deliberately attractive system with no legitimate users, so any interaction with it is suspicious by definition, which gives defenders both a high-fidelity signal and a safe place to watch attacker tooling and technique. To hold offline copies of critical business archives is backup, which supports recovery and attracts nobody. To strip harmful attachments from inbound mail flows is email filtering, a preventive control at a different boundary. To hide internal addresses behind a mapped perimeter describes address translation, which conceals hosts rather than presenting one for study.

52. Which aspect of vulnerability management is specifically concerned with identifying weak points in wireless networks?
    • Capturing traffic from a mirrored network port
    • Sending fake phishing lures to staff mailboxes
    • Surveying radio beacons from a passing vehicle
    • Reviewing firewall rule sets for stale entries

    Correct answer: Surveying radio beacons from a passing vehicle

    Correct answer: Surveying radio beacons from a passing vehicle. Explanation: War driving means moving through an area while recording the wireless networks that advertise themselves, so weak encryption, default network names and unsanctioned access points are found from outside the building where the signal actually reaches. Capturing traffic from a mirrored network port is wired packet capture and cannot see coverage leaking past the walls. Sending fake phishing lures to staff mailboxes tests human susceptibility, which is a different exposure entirely. Reviewing firewall rule sets for stale entries is a configuration review of a wired control and finds nothing about rogue radios.

53. What is the primary function of a Web Application Firewall (WAF) in the context of vulnerability management?
    • Inspecting outbound mail for regulated data tags
    • Terminating remote staff tunnels at the boundary
    • Encrypting stored database columns while at rest
    • Filtering hostile requests aimed at hosted sites

    Correct answer: Filtering hostile requests aimed at hosted sites

    Correct answer: Filtering hostile requests aimed at hosted sites. Explanation: A web application firewall sits in front of the application and inspects requests and responses at the application layer, so injection, scripting and abuse patterns can be blocked or logged before the application ever handles them. Inspecting outbound mail for regulated data tags is data loss prevention, which watches content leaving the organization. Terminating remote staff tunnels at the boundary is remote access work handled by a gateway. Encrypting stored database columns while at rest protects data if storage is stolen and does nothing about a malicious request in flight.

54. When conducting a vulnerability scan, what does "credential scanning" imply?
    • Probing exposed services without any login session
    • Logging into targets with supplied domain accounts
    • Testing logins for reused or predictable passwords
    • Dumping cached password hashes from process memory

    Correct answer: Logging into targets with supplied domain accounts

    Correct answer: Logging into targets with supplied domain accounts. Explanation: A credentialed scan is given working accounts by the asset owner so the scanner can sign in and read installed package versions, registry state and local configuration, which yields findings an outside view can only infer. Probing exposed services without any login session is the uncredentialed mode this term is defined against. Testing logins for reused or predictable passwords is a password strength audit, which attacks accounts rather than using granted ones. Dumping cached password hashes from process memory is attacker credential theft and is never an agreed assessment method.

55. Which strategy in vulnerability management focuses on prioritizing the remediation of vulnerabilities based on the potential impact to the organization?
    • Risk weighted remediation ordering
    • Continuous compliance gap scanning
    • Hypothesis based adversary hunting
    • Hardened baseline change reporting

    Correct answer: Risk weighted remediation ordering

    Correct answer: Risk weighted remediation ordering. Explanation: Risk-weighted ordering combines a weakness's technical severity with what it would actually cost this organization, weighing asset criticality, exposure, exploit activity and compensating controls, so scarce remediation capacity goes to the findings that matter most here. Continuous compliance gap scanning measures conformance to a required standard and treats each gap as equally mandatory. Hypothesis based adversary hunting searches telemetry for intrusions already present and sequences no remediation work. Hardened baseline change reporting tracks drift from an approved build and flags deviation without weighing business consequence.

56. What is the main purpose of a "black box" testing approach in vulnerability assessment?
    • Assessing an environment with no internal knowledge
    • Reviewing source code with full developer knowledge
    • Sharing partial network knowledge with the assessor
    • Testing defender knowledge against a scripted drill

    Correct answer: Assessing an environment with no internal knowledge

    Correct answer: Assessing an environment with no internal knowledge. Explanation: A black box assessment starts from the position of an unfamiliar outsider, with no diagrams, no source and no credentials, so the findings are exactly what an attacker could discover and reach without help. Reviewing source code with full developer knowledge is the white box position, where internal detail is deliberately supplied. Sharing partial network knowledge with the assessor produces a gray box engagement, which trades some realism for coverage. Testing defender knowledge against a scripted drill exercises the response team and says nothing about how much the tester was told.

57. In vulnerability management, what is the significance of a vulnerability's "attack vector"?
    • The scanner plugin that first flagged this weakness
    • The path that an intruder follows toward compromise
    • The vendor update that closes this hole permanently
    • The datacenter that hosts the affected server today

    Correct answer: The path that an intruder follows toward compromise

    Correct answer: The path that an intruder follows toward compromise. Explanation: The attack vector is the route and means of reach, whether network, adjacent network, local or physical, that an attacker must have before the flaw can be exploited, which is why it drives both severity scoring and the choice of compensating control. The scanner plugin that first flagged this weakness names the detection method, a property of the tool rather than of the weakness. The vendor update that closes this hole permanently is the remediation and describes the fix, not the approach. The datacenter that hosts the affected server today is asset placement, which may inform exposure but is not the mechanism of reach.

58. Which of the following best describes the role of "red teaming" in vulnerability management?
    • Adjusting perimeter filters to reduce inbound noise
    • Running tabletop drills for senior leadership teams
    • Mounting covert attacks to test defensive readiness
    • Publishing hardening guides for local system owners

    Correct answer: Mounting covert attacks to test defensive readiness

    Correct answer: Mounting covert attacks to test defensive readiness. Explanation: A red team works quietly against live defenses toward a stated objective, and its deliverable is what the defenders saw, how quickly they saw it and what they did about it, so the exercise measures detection and response rather than producing a catalogue of holes. Adjusting perimeter filters to reduce inbound noise is defensive tuning performed by the blue team. Running tabletop drills for senior leadership teams rehearses decision making in discussion and never touches the live estate. Publishing hardening guides for local system owners is preventive guidance issued long before any exercise takes place.

59. What is the primary purpose of "chain of custody" documentation in the context of vulnerability management?
    • To measure how quickly responders answered each alert
    • To inventory the machines touched during an intrusion
    • To record approvals for changes to security standards
    • To keep seized evidence admissible in future hearings

    Correct answer: To keep seized evidence admissible in future hearings

    Correct answer: To keep seized evidence admissible in future hearings. Explanation: Chain of custody records who collected each item, who held it, when it moved and what was done to it, so a court can be satisfied that the material presented is the material collected and that nothing altered it along the way. To measure how quickly responders answered each alert is a response metric and speaks to team performance. To inventory the machines touched during an intrusion is scoping work that establishes the extent of the event. To record approvals for changes to security standards is governance documentation and carries no evidentiary weight.

60. During a cyber incident response, which type of analysis focuses on identifying the tactics, techniques, and procedures (TTPs) of attackers?
    • Structured protocol analysis
    • Historical firewall analysis
    • Statistical anomaly analysis
    • Threat intelligence analysis

    Correct answer: Threat intelligence analysis

    Correct answer: Threat intelligence analysis. Explanation: Threat intelligence analysis studies adversary behavior across campaigns, describing how a group gains access, moves, persists and acts on its objectives, and expresses that as tactics, techniques and procedures defenders can hunt for and map to controls. Structured protocol analysis decomposes traffic against a specification and characterizes packets, not actors. Historical firewall analysis reviews allow and deny records for a single control and shows connection outcomes rather than adversary tradecraft. Statistical anomaly analysis flags deviation from a learned norm and reports that something is unusual without saying who did it or how.

61. In the context of incident response, what is the primary purpose of a 'kill chain' model?
    • To assign responder roles across the duty rotation
    • To rank fresh findings by their exploit likelihood
    • To characterize the ordered stages of an intrusion
    • To record lessons captured once an incident closes

    Correct answer: To characterize the ordered stages of an intrusion

    Correct answer: To characterize the ordered stages of an intrusion. Explanation: A kill chain breaks an attack into sequential phases, running from reconnaissance through delivery and exploitation to actions on objectives, so defenders can place detection and disruption at each step and reason about how far an intrusion progressed before it was caught. To assign responder roles across the duty rotation is staffing for the response function. To rank fresh findings by their exploit likelihood is vulnerability prioritization, which orders defects rather than describing attacker progression. To record lessons captured once an incident closes belongs to the post-incident review that follows containment and recovery.

62. Which of the following is a key activity in the Preparation phase of the Incident Response Lifecycle?
    • Drafting notification plans for likely incident types
    • Isolating infected devices from the corporate network
    • Reconstructing the contributing causes of an incident
    • Estimating how many customer records were exfiltrated

    Correct answer: Drafting notification plans for likely incident types

    Correct answer: Drafting notification plans for likely incident types. Explanation: Preparation is the work done while nothing is on fire, covering the team, tooling, playbooks and the settled question of who must be told, through which channel and how fast, so nobody has to invent a notification path during a live event. Isolating infected devices from the corporate network is containment, which happens once an incident is confirmed. Reconstructing the contributing causes of an incident is analysis and post-incident activity performed after the fact. Estimating how many customer records were exfiltrated is impact assessment carried out during and after the response, never before it.

63. What is the main objective of triage in cybersecurity incident response?
    • Returning the failed services to earlier working status
    • Logging the custody handoff for each seized workstation
    • Ranking the incoming reports by assessed severity level
    • Deleting the hostile binaries left on infected desktops

    Correct answer: Ranking the incoming reports by assessed severity level

    Triage sits at the front of the response: reports arrive faster than a team can work them, so each is assessed and ranked by severity and urgency, and the most damaging get an analyst first. Returning failed services to a working state is recovery, which happens only after the threat is gone. Logging a custody handoff is evidence handling that supports a later investigation. Deleting hostile binaries is eradication, and both of those presume the incident has already been classified and prioritised.

64. In incident response, what is the significance of the term 'Indicators of Compromise' (IoCs)?
    • Observed traces suggesting a server was silently breached
    • Preventive safeguards blocking an attack at the perimeter
    • Timing measures showing how fast analysts answered alerts
    • Funding profiles describing an actor group's known budget

    Correct answer: Observed traces suggesting a server was silently breached

    Indicators of compromise are observable forensic traces, such as unexpected outbound connections, altered system files or anomalous account use, that suggest a host has already been breached, which is why they drive detection and scoping. Preventive safeguards at the perimeter are controls placed before an attack rather than evidence one succeeded. Timing measures of analyst turnaround are response metrics. Funding and resourcing profiles belong to threat-actor intelligence, describing who might attack rather than showing that something already has.

65. Which tool is most commonly used in the containment phase of a cybersecurity incident response to isolate affected systems?
    • A monitor alerting on suspicious packets it observes
    • A gateway checking outbound files for tagged content
    • A scanner removing known malware from infected disks
    • A firewall discarding traffic bound for the endpoint

    Correct answer: A firewall discarding traffic bound for the endpoint

    Containment means isolating the affected host, and the firewall or equivalent network access control is the usual instrument: rules are changed so traffic to and from the compromised endpoint is discarded, cutting the attacker's reach while the machine stays powered on for analysis. An intrusion detection sensor observes and alerts but blocks nothing on its own. A data loss prevention gateway inspects outbound content against policy rather than quarantining a host. Antimalware cleans infected media, which is eradication, not isolation.

66. What is the primary goal of 'chain of custody' in the context of cyber incident response?
    • Building the event timeline reconstructed from server logs
    • Showing the seized evidence stayed intact between handlers
    • Assigning the response duties handled by each investigator
    • Publishing the breach notices required by state regulators

    Correct answer: Showing the seized evidence stayed intact between handlers

    Chain of custody is the unbroken record of who held each item, when, and why, and its purpose is to show that evidence was not altered as it moved between handlers. Without it, otherwise sound findings can be excluded from a proceeding. An incident timeline reconstructed from logs describes what the attacker did, not who held the evidence. Assigning response duties is a staffing matter fixed by the response plan. Publishing a breach notice discharges a regulatory obligation and has no bearing on evidentiary integrity.

67. In cyber incident response, what is the primary purpose of performing a root cause analysis?
    • Costing the revenues forfeited during the prolonged outage
    • Finding the technical fault behind the observed compromise
    • Filing the closing statement retained for future reference
    • Grading the analyst reaction shown throughout the response

    Correct answer: Finding the technical fault behind the observed compromise

    Root cause analysis asks why the compromise was possible at all, working back from the observed effects to the underlying technical fault: the unpatched service, the misconfiguration, the control that was never enabled. Costing forfeited revenue is business impact analysis. Filing a closing statement is reporting, which records the response rather than explaining the failure. Grading analyst reaction measures how the team performed, which belongs to the lessons-learned review and says nothing about how the attacker got in.

68. Which phase of the Incident Response Lifecycle involves analyzing the incident to improve future response and prevention measures?
    • Preparing the checklists consulted by the analyst rosters
    • Analyzing the telemetry gathered from the alerting probes
    • Isolating the intruders inside a single network partition
    • Reviewing the response once the affected services resumed

    Correct answer: Reviewing the response once the affected services resumed

    The post-incident activity phase runs once operations are back: the team reviews the response, captures lessons learned, and feeds concrete changes into detection content, tooling and the plan itself. Preparing playbooks and rosters is preparation, done before any alert exists. Working through telemetry from alerting probes is detection and analysis, which establishes that an incident is real. Isolating an intruder in a network partition is containment, taken while the incident is still live.

69. In the context of cyber incident response, what is the purpose of using sandboxes?
    • Detonating unknown files inside a walled test environment
    • Rehearsing the critical server restore from clean backups
    • Probing the live defenses using sanctioned attack tooling
    • Scrambling archived records held on detachable tape media

    Correct answer: Detonating unknown files inside a walled test environment

    A sandbox is an instrumented, walled-off environment where a suspicious file can be executed and watched, so the analyst learns what it drops, what it contacts and how it persists without exposing a production host. Rehearsing a server restore from backups tests recovery capability. Probing live defences with sanctioned attack tooling is penetration testing, an assurance activity rather than malware analysis. Scrambling archived records on removable media is encryption at rest, which protects stored data instead of revealing behaviour.

70. What role does 'attribution' play in cyber incident response?
    • Estimating the business disruption produced by the shutdown
    • Rebuilding the compromised hosts from trusted vendor images
    • Identifying the outside group responsible for the intrusion
    • Deploying the extra controls chosen during remediation work

    Correct answer: Identifying the outside group responsible for the intrusion

    Attribution ties the observed tradecraft, infrastructure and tooling to the actor behind the intrusion, which shapes what the team should expect next and any law-enforcement or disclosure path. Estimating business disruption is impact assessment. Rebuilding compromised hosts from trusted media is recovery. Deploying extra controls during remediation hardens the environment against a repeat. All three follow from the incident, but none of them establishes who conducted it.

71. During an incident response, what is the significance of 'time stamps' in log files?
    • They establish the sequencing of the separate logged events
    • They contain the priority assigned by the logging subsystem
    • They name the originating server emitting the stored record
    • They list the processes generating each newly written entry

    Correct answer: They establish the sequencing of the separate logged events

    Timestamps are what let scattered records from different systems be merged into one ordered narrative, so an analyst can see what happened before what and where the intrusion actually began. Priority is a separate field written by the logging subsystem and expresses severity, not time. The originating host is recorded in its own field, as is the process that produced the entry. Those fields identify a source; only the timestamp puts the events in order.

72. In the context of cybersecurity incident response, what is a 'honeypot' primarily used for?
    • Holding offline copies of critical company archives safely
    • Screening malicious messages away from the local mailboxes
    • Attracting intruders onto a deceptive host worth observing
    • Scrambling stored records so theft returns unreadable data

    Correct answer: Attracting intruders onto a deceptive host worth observing

    A honeypot is a deliberately exposed decoy that imitates a vulnerable system. It carries no production role, so any interaction with it is suspicious by definition, and it lets defenders watch attacker behaviour safely. Holding offline copies of company archives is backup. Screening malicious messages out of mailboxes is a secure email gateway. Scrambling stored records so theft yields nothing readable is encryption at rest. All three are real controls, but none of them draws an attacker in to be observed.

73. What is the purpose of 'data exfiltration analysis' in cyber incident response?
    • Measuring the analyst tickets completed within each shift
    • Establishing the records copied out during the compromise
    • Verifying the nightly jobs finished without logged errors
    • Confirming the restored files match the original checksum

    Correct answer: Establishing the records copied out during the compromise

    Exfiltration analysis works out exactly what data left the environment, which stores were touched and where it went, because that answer drives notification duties, regulatory exposure and the scope statement given to customers. Measuring analyst caseload per shift is an operations metric. Verifying that nightly jobs finished is backup monitoring. Confirming that restored files match their original checksum validates a recovery. None of those establishes what the attacker took.

74. In incident response, what is the main goal of 'eradication'?
    • Recovering the disrupted services to their prior operation
    • Explaining the underlying weakness exploited by the actors
    • Archiving the closing write-up retained for later auditors
    • Stripping the attacker tooling from the compromised assets

    Correct answer: Stripping the attacker tooling from the compromised assets

    Eradication removes the attacker's footholds from the affected assets: malware, web shells, scheduled tasks, added accounts and modified binaries all have to go, or the environment is reinfected as soon as it is returned to service. Recovering disrupted services to their prior operation is the recovery step that follows. Explaining the underlying weakness is root cause analysis. Archiving a closing write-up is post-incident documentation. Each is a genuine stage, but none of them strips out the hostile components.

75. Which activity in cyber incident response involves determining the scope and impact of the incident?
    • Preparation of the checklists rehearsed by the responders
    • Containment of the damage limited by network segmentation
    • Restoration of the databases recovered from clean backups
    • Identification of the machines disturbed by the intruders

    Correct answer: Identification of the machines disturbed by the intruders

    Identification is where the team confirms the incident is real and sizes it: which machines were disturbed, which accounts were abused, and what data was reachable. That scope statement is what every later decision depends on. Preparation covers the checklists and rosters put in place beforehand. Containment limits damage once the scope is known. Restoration brings services back at the end. None of those establishes how far the intrusion actually reached.

76. In cyber incident response, what is the purpose of using 'SIEM' (Security Information and Event Management) tools?
    • Encrypting traffic between two endpoints across public links
    • Collecting alerts from multiple sources for central analysis
    • Filtering inbound packets against a written boundary ruleset
    • Probing computers for missing patches at scheduled intervals

    Correct answer: Collecting alerts from multiple sources for central analysis

    A SIEM aggregates and correlates: it pulls events from firewalls, endpoints, servers and applications into one place, normalises them and raises correlated alerts an analyst can work, which is what makes cross-system detection possible. Encrypting traffic between endpoints is the job of a VPN or TLS. Filtering inbound packets against a ruleset is a firewall. Probing computers for missing patches is a vulnerability scanner. Each is a real tool, but none of them is the central collection and analysis platform.

77. What is a primary consideration when choosing a communication method during a cyber incident response?
    • Whether the platform keeps a searchable message archive
    • Whether analysts already know the tool's basic controls
    • Whether the channel remains outside an intruder's reach
    • Whether the system reaches responders at overseas sites

    Correct answer: Whether the channel remains outside an intruder's reach

    An intruder still inside the estate may be reading the same mail and chat the responders use, so the first question about any incident channel is whether it stays out of band, beyond the compromised systems and protected in transit. A searchable archive matters for later legal hold, familiarity with the tool speeds adoption, and reach to remote responders affects availability. Those are genuine considerations, but each is subordinate to keeping the response itself from being watched by the attacker.

78. In the context of cyber incident response, what is the role of 'digital forensics'?
    • Examining the captured images to reconstruct the compromise
    • Rebuilding the failed servers from trusted install packages
    • Deploying the mitigating controls across the local networks
    • Calculating the residual risk within the hardware inventory

    Correct answer: Examining the captured images to reconstruct the compromise

    Digital forensics is the disciplined examination of acquired evidence, including disk and memory images, network captures and logs, to reconstruct what the attacker did, in what order and with what access. Rebuilding failed servers from trusted packages is recovery. Deploying mitigating controls is remediation. Calculating residual risk over the hardware inventory is a risk-management exercise. All three may follow an incident, but none of them analyses the evidence itself.

79. Which phase in the incident response process involves taking actions to minimize the impact of the incident?
    • Monitoring the detection console for an initial indication
    • Digging through the captured artifacts to explain behavior
    • Disconnecting the intruder from the remaining clean estate
    • Documenting the improvement lessons drawn once work closes

    Correct answer: Disconnecting the intruder from the remaining clean estate

    Containment deliberately limits the blast radius: affected hosts are cut off from the rest of the estate so the intruder cannot move laterally while the team works out the full scope. Watching the detection console for a first indication is detection. Working through captured artifacts to explain behaviour is analysis. Documenting improvement lessons is post-incident activity. Only containment reduces harm while the incident is still running.

80. Which type of report in cybersecurity incident response typically includes detailed technical information about the incident and its remediation?
    • An executive report framing the commercial impact concisely
    • A closing report capturing the improvement actions proposed
    • An advance report announcing the newly confirmed detections
    • An engineering report detailing the remediation steps taken

    Correct answer: An engineering report detailing the remediation steps taken

    The technical incident report is written for engineers and security staff. It carries the indicators, the affected systems, the attack path and the remediation actually applied, at a depth the rest of the audience does not need. An executive report deliberately compresses all of that to commercial consequence. A closing report records the improvement actions to be pursued. An early notification announces a confirmed detection before the technical picture exists. Only one of them carries the technical detail.

81. In incident response, what is the primary purpose of 'war gaming' exercises?
    • Stressing the response plan against a simulated adversary
    • Checking the badge scanners against a tailgating incident
    • Running the authenticated scan against a corporate estate
    • Verifying the backup snapshots against a complete failure

    Correct answer: Stressing the response plan against a simulated adversary

    War gaming puts the plan under adversarial pressure: an opposing force acts out an attack while the response team works the incident live, which exposes gaps a read-through never surfaces and improves the capability itself. Checking badge scanners against a tailgating attempt is a physical security test. Running an authenticated scan across a corporate estate is vulnerability management. Verifying backup snapshots against a total failure is a recovery test. None of those exercises the team against a thinking opponent.

82. What is the primary goal of 'containment strategies' in the incident response process?
    • Scrubbing the malicious files off an infected workstation
    • Trapping the intrusion inside an already affected segment
    • Recovering the scrambled databases from an offsite backup
    • Preserving the forensic artifacts for an eventual hearing

    Correct answer: Trapping the intrusion inside an already affected segment

    Containment strategies exist to stop the spread: isolate the affected segment, disable the abused accounts and cut the command-and-control path, so the incident never reaches systems that are still clean. Scrubbing malicious files off an infected workstation is eradication, which comes afterwards. Recovering databases from an offsite backup is recovery. Preserving forensic artifacts supports the investigation and any later proceeding. Each is a legitimate step, but only containment limits how far the incident gets.

83. During a cyber incident, what is the role of a 'crisis communication plan'?
    • Dividing what the responder handles inside a workstream
    • Governing what the organisation tells the outside world
    • Encrypting what the senior leaders discuss each evening
    • Tracking what the newspapers publish about the incident

    Correct answer: Governing what the organisation tells the outside world

    A crisis communication plan governs external messaging: who speaks, what has been confirmed, when customers, regulators and the press are told, and through which channel, so the organisation says one accurate thing rather than several conflicting ones. Dividing work inside the response team is set out in the response plan. Encrypting what leaders discuss is a secure-channel control. Tracking what newspapers publish is media monitoring, which watches the outside world rather than addressing it.

84. In the aftermath of a cybersecurity incident, what is the main focus of 'recovery strategies'?
    • Reinstating the operations to their expected service level
    • Pursuing the attacker through the available legal channels
    • Costing the disruption against the quarterly revenue total
    • Rewriting the policies the incident revealed as inadequate

    Correct answer: Reinstating the operations to their expected service level

    Recovery is about getting the business running again: systems are rebuilt or restored from known-good sources, validated, and returned to their expected service level under heightened monitoring. Pursuing the attacker through legal channels is a law-enforcement path. Costing the disruption against revenue is impact analysis. Rewriting policies the incident showed to be inadequate is a lessons-learned improvement. Each may follow the incident, but none of them puts service back.

85. In cybersecurity, what is an 'incident playbook' primarily used for?
    • Recording the control evidence for the external auditor
    • Calculating the losses a single intrusion has generated
    • Introducing the new analysts into the operations centre
    • Detailing the response steps for each incident category

    Correct answer: Detailing the response steps for each incident category

    A playbook is the pre-written, step-by-step procedure for one class of incident, such as ransomware, phishing or data exfiltration, so responders act consistently and quickly instead of improvising under pressure. Recording control evidence for an external auditor is compliance work. Calculating what a single intrusion cost is a risk and finance exercise. Introducing new analysts to the operations centre is onboarding. A playbook may assist training, but its purpose is to prescribe the response.

86. What is the main purpose of conducting 'tabletop exercises' in incident response planning?
    • Challenging the locked doorway with a determined intruder
    • Refining the detection rules with recorded attack traffic
    • Rehearsing the documented plan with a discussion scenario
    • Auditing the firewall rulesets with fresh vendor guidance

    Correct answer: Rehearsing the documented plan with a discussion scenario

    A tabletop exercise is discussion-based: participants are walked through a realistic scenario and talk through the decisions they would make, which surfaces unclear ownership, stale contacts and unworkable steps cheaply and without touching production. Challenging a locked doorway is a physical penetration test. Refining detection rules with recorded attack traffic is detection engineering. Auditing a firewall ruleset against vendor guidance is configuration review. None of those rehearses the plan with the people who must run it.

87. Which factor is most critical when establishing the severity level of a cybersecurity incident?
    • The disruption striking the firm's core business operations
    • The quantity appearing from the overnight monitoring alerts
    • The supplier providing the applications the attacker abused
    • The console reporting the intruder's behaviour each morning

    Correct answer: The disruption striking the firm's core business operations

    Severity is set by consequence: how far critical business processes are degraded and how sensitive the data reached is. That is what drives escalation thresholds, notification duties and the resources released to the response. Overnight alert volume describes sensor noise. The supplier of the abused application matters for patching, not for grading the incident. The console that first reported the behaviour is a detection-source detail. All three appear on the incident record; none of them measures harm.

88. In incident response, what is the importance of 'root cause analysis'?
    • Grading the responders against the published service targets
    • Notifying the regulators expecting a detailed breach summary
    • Selecting the supplier rebuilding the failed database server
    • Uncovering the flaws permitting the initial hostile foothold

    Correct answer: Uncovering the flaws permitting the initial hostile foothold

    Root cause analysis earns its place by naming the weakness that made initial entry possible, whether an unpatched edge device, a missing multifactor requirement or an over-permissive share, so the fix closes the class of problem instead of the single symptom. Grading responders against service targets measures the team, not the environment. Notifying regulators discharges a legal duty. Selecting a supplier to rebuild a failed server is a procurement decision. None of those identifies the weakness.

89. What is the role of 'situational awareness' in the context of cybersecurity incident response?
    • Scheduling a supplier patch across the corporate estate
    • Capturing a lesson from the previously closed incidents
    • Maintaining a current picture of the threat environment
    • Monitoring a spending limit for the security department

    Correct answer: Maintaining a current picture of the threat environment

    Situational awareness is the continuously refreshed picture of the current threat environment, drawn from intelligence feeds, internal sensors and knowledge of what the estate should look like, and it is what lets a team notice an emerging incident early rather than after the damage. Scheduling supplier patches is vulnerability management. Capturing a lesson from previously closed incidents looks backwards. Monitoring a spending limit is programme administration. None of those maintains the current picture.

90. In the context of security architecture, what is the primary purpose of a Data Loss Prevention (DLP) system?
    • Blocking hostile packets from entering the trusted perimeter
    • Stopping sensitive records from leaving the internal network
    • Removing malicious scripts from retrieved external web pages
    • Detonating unknown binaries away from the corporate machines

    Correct answer: Stopping sensitive records from leaving the internal network

    Data loss prevention classifies content and then blocks or quarantines it when a protected record is about to leave by email, upload, removable media or cloud sync, whether the sender intended it or not. Blocking hostile packets at the trusted perimeter is what a firewall does. Removing malicious scripts from retrieved web pages is a secure web gateway function. Detonating unknown binaries away from corporate machines is sandboxing. All are real controls, but only one watches sensitive content on its way out.

91. Which security concept involves distributing a set of backup keys to trusted individuals for safekeeping?
    • Public key infrastructure issuing certificates to the client
    • Multifactor authentication combining a password plus a token
    • Symmetric encryption sharing a single secret between parties
    • Key escrow depositing duplicated copies with an intermediary

    Correct answer: Key escrow depositing duplicated copies with an intermediary

    Key escrow lodges a duplicate of a cryptographic key with a trusted third party, so encrypted material can still be recovered when the holder loses the key or a lawful demand requires access. Public key infrastructure issues and validates certificates; it does not retain spare private keys for recovery. Multifactor authentication proves identity using more than one factor. Symmetric encryption describes a single shared secret used in both directions. None of those is a custodial arrangement for spare keys.

92. What is the primary function of a Security Information and Event Management (SIEM) system?
    • Applying the signature updates pushed to endpoint scanners
    • Enforcing the hardening baselines held for local computers
    • Correlating the audit trails gathered by monitored devices
    • Probing the external addresses exposed by outside services

    Correct answer: Correlating the audit trails gathered by monitored devices

    A SIEM ingests logs and events from across the estate, normalises them into a common form and correlates them, which is what turns unrelated records into a single alert an analyst can act on. Applying signature updates to endpoint scanners is antimalware administration. Enforcing hardening baselines on desktops is configuration management. Probing exposed external addresses is vulnerability scanning. Each produces data a SIEM might consume, but none of them is the aggregation and correlation platform.

93. In cybersecurity, what is the primary purpose of implementing a Zero Trust architecture?
    • Concentrating stronger defences at a single outer boundary
    • Verifying each request regardless of its network placement
    • Layering repeated controls behind the main defensive lines
    • Splitting sensitive duties so lone operators cannot finish

    Correct answer: Verifying each request regardless of its network placement

    Zero Trust removes location as a basis for trust: every request is authenticated, authorised and judged against device and context signals, whether it arrives from a coffee shop or a corporate switch port. Concentrating stronger defences at one outer boundary is the perimeter model Zero Trust was built to replace. Stacking repeated controls behind the main line is defence in depth. Splitting sensitive duties so no lone operator can finish a transaction is separation of duties. Only one of them removes implicit internal trust.

94. Which tool is primarily used for real-time monitoring of network traffic and packet analysis?
    • Wireshark
    • Greenbone
    • Checkmarx
    • Forescout

    Correct answer: Wireshark

    Wireshark is a protocol analyser: it captures frames off the wire as they pass and decodes each one field by field, which is what live traffic monitoring and packet-level inspection require. Greenbone performs authenticated vulnerability assessment against hosts and reports missing patches, not packet decodes. Checkmarx analyses application source code for insecure patterns and never touches the network. Forescout profiles and admits endpoints as they join the network, enforcing access policy rather than dissecting traffic.

95. What is the function of a Web Application Firewall (WAF) in cybersecurity?
    • To filter packets by port numbers at the internal firewall
    • To screen HTTP requests sent to one hosted web application
    • To spread client sessions over a farm of identical servers
    • To encrypt a browser session with a public key certificate

    Correct answer: To screen HTTP requests sent to one hosted web application

    A web application firewall works at the application layer: it examines each HTTP request and response destined for a protected site and blocks the ones carrying injection, cross-site scripting or other web attack payloads. A traditional packet firewall decides on addresses and ports and cannot read the request body. A load balancer distributes sessions for capacity and availability, which is a performance function rather than an inspection one. Transport encryption protects data in transit but does nothing about a malicious request arriving inside the encrypted channel.

96. Which technology is primarily used to isolate and run suspicious code or files in a controlled environment?
    • Network intrusion prevention
    • Removable media sanitization
    • Automated sandbox detonation
    • Security orchestration suite

    Correct answer: Automated sandbox detonation

    A sandbox executes an unknown sample inside an instrumented and disposable environment so its behaviour can be observed without exposing production systems; detonation is the standard term for running a suspect file that way. Intrusion prevention inspects traffic in line and drops hostile sessions, but it never runs the sample. Media sanitization destroys residual data on drives being retired. A security orchestration suite chains together the tools that respond once a verdict already exists, so none of the three provides isolated execution.

97. What is the primary purpose of a Network Access Control NAC system?
    • To build an IPsec tunnel between two branch office sites
    • To gather host log records inside a central SIEM archive
    • To clone production data volumes across to a SAN cluster
    • To admit devices onto the LAN after a posture assessment

    Correct answer: To admit devices onto the LAN after a posture assessment

    Network access control evaluates a device before it is allowed to communicate: identity, patch level, agent presence and configuration are checked, and the port is opened, quarantined or refused according to policy. A site-to-site tunnel protects traffic in transit between locations but makes no admission decision. Log collection supports detection and investigation after the fact. Replicating volumes to shared storage provides recoverability. Only the admission decision enforces policy at the moment a device asks to join.

98. In the context of cloud security, what is the main function of a Cloud Access Security Broker CASB?
    • To audit the cloud account settings against a secured baseline
    • To replicate cloud data buckets into a distant provider region
    • To police the way staff reach any sanctioned cloud application
    • To rotate the tenant secrets for objects inside cloud archives

    Correct answer: To police the way staff reach any sanctioned cloud application

    A cloud access security broker sits in the path between users and the cloud services they consume and acts as a policy enforcement point there, giving visibility into who is using which service and applying access, data protection and threat controls to that usage. Posture auditing grades the provider-side configuration instead. Cross-region replication is a durability measure. Secret rotation protects stored objects. None of those three mediates the user-to-service session the question describes.

99. What is the primary role of an Intrusion Detection System (IDS) in a network security architecture?
    • To rewrite the source address seen on each outbound packet
    • To prove the user identity during an initial login attempt
    • To discard a hostile session inline ahead of the recipient
    • To raise an alert when inbound traffic matches a signature

    Correct answer: To raise an alert when inbound traffic matches a signature

    An intrusion detection system observes a copy of the traffic, compares it with signatures and behavioural baselines, and raises an alert for an analyst; detection and notification are its entire remit. Address translation hides internal addressing and is a routing function. Proving identity at login belongs to authentication services. Discarding a session in line is what an intrusion prevention system does, and that in-path blocking is precisely the capability a detection-only sensor lacks.

100. Which type of security testing focuses on evaluating software by observing its execution and monitoring responses to different inputs?
     • Reading through the source tree for unsafe function call patterns
     • Driving a running build with crafted input while watching replies
     • Listing out each third-party library beside a published flaw list
     • Mapping the design against a catalogue of probable attacker goals

     Correct answer: Driving a running build with crafted input while watching replies

     Dynamic application security testing exercises the application while it is running: inputs are supplied from the outside, the responses and error behaviour are observed, and defects are inferred from how the live system reacts. Reading the source without executing it is static analysis. Enumerating third-party components against advisories is software composition analysis, which reports defects someone else has already published. Mapping a design against attacker goals is threat modelling, a paper exercise performed before any code runs.

101. What is the primary purpose of the Security Assertion Markup Language (SAML) in cloud security?
     • To hand a signed authentication claim between two trusted parties
     • To register fresh user accounts inside each linked cloud platform
     • To wrap each browser session within a negotiated transport cipher
     • To store the group permissions for an on-premises document server

     Correct answer: To hand a signed authentication claim between two trusted parties

     SAML is an XML standard for passing signed assertions about a subject between an identity provider and a service provider, so one party can vouch to another for who the user is and what attributes they carry. Account creation across linked services is handled by a provisioning standard. Negotiating a transport cipher protects the channel but says nothing about identity. Storing group permissions on a file server is local access control and never crosses a trust boundary.

102. In cybersecurity, what is the function of a Threat Intelligence Platform (TIP)?
     • To correlate internal log events inside a prioritised alert queue
     • To gather feeds of adversary indicators into one enriched archive
     • To test servers for missing patches against a published catalogue
     • To push out approved updates onto the managed corporate endpoints

     Correct answer: To gather feeds of adversary indicators into one enriched archive

     A threat intelligence platform ingests indicator feeds from commercial, open and community sources, deduplicates and normalises them, adds context such as actor and campaign, and makes the result available to the tools and analysts that need it. Correlating internal events into ranked alerts is what a SIEM does with telemetry the organisation generates itself. Testing against a defect catalogue is vulnerability assessment. Distributing approved updates is patch management, an operational task rather than an intelligence one.

103. Which type of tool is most effective for detecting vulnerabilities in a network before an attacker does?
     • An authenticated network scanner
     • A continuous performance monitor
     • A distributed perimeter firewall
     • An automated detection appliance

     Correct answer: An authenticated network scanner

     A vulnerability scanner enumerates hosts, services and software versions and compares what it finds against a defect database, which surfaces exposures while they can still be fixed; running it with credentials produces the fullest and most accurate picture. A performance monitor watches throughput and latency and is blind to security defects. A perimeter firewall enforces an allow or deny decision on traffic but never inventories the weaknesses behind it. A detection appliance alerts on attacks in progress, which is knowledge arriving after the attacker has already begun.

104. In a cybersecurity context, what is the main purpose of implementing microsegmentation in a network?
     • To carry branch office traffic over an encrypted tunnel
     • To retain a record of administrator commands for review
     • To share inbound requests among a redundant server pool
     • To stop lateral spread between two close workload zones

     Correct answer: To stop lateral spread between two close workload zones

     Microsegmentation places a policy boundary around individual workloads so that east-west traffic between them is permitted only where a rule explicitly allows it, which confines an intruder to the machine already compromised. An encrypted tunnel protects traffic between sites but leaves the flat internal network intact once traffic arrives. Command logging supports investigation after the event. Spreading requests among redundant servers serves capacity and availability, and none of those three limits movement inside the network.

105. What is the primary goal of Security Orchestration, Automation, and Response (SOAR)?
     • To index raw security log sources inside one searchable database
     • To profile the user behaviour against a settled statistical norm
     • To run stored response playbooks across the linked defence tools
     • To encrypt the archived case documents held in long-term storage

     Correct answer: To run stored response playbooks across the linked defence tools

     Security orchestration, automation and response exists to turn repeatable analyst work into playbooks that call the surrounding tools through their interfaces, so enrichment, containment and ticketing steps execute consistently and without waiting for a human. Indexing logs into a searchable store is the collection layer a SIEM provides. Profiling user behaviour against a baseline is analytics that produces detections. Encrypting archived case material protects records at rest. None of those three executes the workflow itself.

106. Which technology is primarily used to protect sensitive data by transforming it into an unreadable format?
     • Segmentation
     • Minimization
     • Interception
     • Tokenization

     Correct answer: Tokenization

     Tokenization replaces a sensitive value such as a card number with a surrogate that has no exploitable meaning outside the vault that maps it back, so systems downstream hold data they cannot read or reverse. Segmentation divides a network into zones and protects systems rather than the values inside them. Data minimization reduces how much is collected in the first place but leaves whatever remains readable. Interception decrypts and inspects traffic in transit, which exposes content rather than obscuring it.

107. What is the main function of a Next-Generation Firewall (NGFW) in cybersecurity?
     • To hold a suspect binary inside an isolated analysis machine
     • To grant workers one signed token for many federated portals
     • To judge sessions by application type rather than port alone
     • To watch the host processes for signs of ransomware activity

     Correct answer: To judge sessions by application type rather than port alone

     A next-generation firewall extends stateful filtering with deep inspection: it identifies the actual application carried in a flow whatever port it uses, applies user identity, and folds in intrusion prevention and threat intelligence to reach one policy decision. Detonating a suspect binary in an isolated machine is sandboxing. Issuing one signed token for many portals is federated single sign-on. Watching process behaviour on a host is endpoint detection, and all three operate somewhere other than the network policy boundary.

108. In cybersecurity, what is the primary role of an Endpoint Detection and Response (EDR) tool?
     • To record laptop process activity then isolate one infected host
     • To gather firewall proxy records into one central review console
     • To bar unknown hardware from the corporate wired network segment
     • To scramble the contents of a missing workstation disk partition

     Correct answer: To record laptop process activity then isolate one infected host

     Endpoint detection and response instruments the host itself, streaming process, file, registry and network telemetry to a console where behavioural detections fire and an analyst can kill a process, quarantine a file or cut the machine off the network remotely. Gathering network device records into a console is SIEM collection. Barring unknown hardware from a network segment is admission control. Full-disk encryption defends data on a missing machine but produces no telemetry and takes no action against a live intrusion.

109. In cybersecurity, what is the purpose of a Secure Web Gateway (SWG)?
     • To shield a public web server from active injection attempts
     • To filter staff web traffic against an acceptable use policy
     • To grant remote workers an encrypted tunnel into head office
     • To rank bandwidth priority for real-time voice over the link

     Correct answer: To filter staff web traffic against an acceptable use policy

     A secure web gateway sits between users and the internet and inspects their outbound browsing, applying URL categorisation, malware scanning and the organisation's acceptable use rules before a page is delivered. Shielding a public site from injection is the job of a web application firewall, which protects the server side rather than the user side. A remote access tunnel provides confidentiality for staff working off site. Prioritising voice traffic is quality of service, a capacity control with no policy or content role.

110. Which cybersecurity tool is specifically designed to protect against malware and exploits targeting mobile devices?
     • Mobile device management
     • Wireless rogue detection
     • Endpoint disk encryption
     • Removable media controls

     Correct answer: Mobile device management

     Mobile device management is the control built for handsets and tablets: it enrols the device, enforces a hardened configuration, requires screen lock and encryption, pushes operating system and application updates that close known exploits, restricts installation to approved sources, and wipes a device that is lost or non-compliant. Rogue detection looks for unauthorised access points in the radio space. Disk encryption protects data on a stolen computer. Media controls restrict what can be written to removable storage, and none of the three governs the mobile platform itself.

111. Which technology is primarily used to detect and prevent data exfiltration via email in an organization?
     • Internal email archiving
     • Corporate email indexing
     • Redundant email queueing
     • Outbound email filtering

     Correct answer: Outbound email filtering

     Filtering messages on the way out is what catches data leaving by email: the gateway inspects recipients, bodies and attachments against content rules and blocks, quarantines or encrypts anything that breaches policy. Archiving retains copies for retention and discovery obligations but never stops a message. Indexing makes stored mail searchable. Queue redundancy keeps mail flowing when a node fails. All three are legitimate mail services, yet only inspection of outbound content can detect and prevent an exfiltration attempt.

112. What is the main purpose of employing a Security Assertion Markup Language (SAML) in a federated identity management system?
     • To push a second factor challenge onto the primary handset
     • To copy directory group records into a linked account list
     • To let a single login unlock many partner service gateways
     • To sign the audit archive so entries cannot be overwritten

     Correct answer: To let a single login unlock many partner service gateways

     In a federation the identity provider authenticates the user once and then issues an assertion that each participating service provider trusts, so the user reaches every partner application without presenting credentials again; that is single sign-on. A second-factor challenge strengthens one authentication event but does not carry it to another party. Copying directory records into a downstream list is provisioning. Signing an audit archive protects its integrity, and none of those three removes the repeated login.

113. In the context of security architecture, what is a primary function of a Botnet Detection System?
     • To push vendor patches onto servers inside each patch window
     • To flag internal hosts in constant contact with a controller
     • To renew the old certificates issued to public web endpoints
     • To hold archived log records for the agreed retention period

     Correct answer: To flag internal hosts in constant contact with a controller

     Botnet detection looks for the traffic pattern that gives an infected host away: regular beacons to a command and control node, domain generation algorithm lookups, or participation in a flood aimed at a third party. Patch deployment closes the defects that let the infection in but sees nothing once a host is enrolled. Certificate renewal keeps trusted services reachable. Log retention preserves history for later review. None of those three identifies the command channel while it is active.

114. What role does a Security Information and Event Management (SIEM) system play in the Incident Response process?
     • It images the affected drive so the evidence stays intact
     • It merges the log feeds so events line up chronologically
     • It cuts the infected host away from the corporate network
     • It tracks a case file through an agreed response workflow

     Correct answer: It merges the log feeds so events line up chronologically

     During an incident the security information and event management platform is the place where telemetry from firewalls, endpoints, servers and applications is normalised and correlated, so responders can build one timeline and see the relationship between events that arrived from different systems. Forensic imaging preserves a single drive for examination. Cutting a host off the network is a containment action taken by an endpoint or access control tool. Case tracking is handled by the ticketing or orchestration layer.

115. Which tool is essential for identifying unknown vulnerabilities in software applications before they are deployed?
     • A crawler probing a running instance for missing input validation
     • A checker matching each named library against public defect lists
     • A scanner reading the whole codebase for insecure coding patterns
     • A monitor watching the live servers for unusual outbound sessions

     Correct answer: A scanner reading the whole codebase for insecure coding patterns

     Static application security testing inspects source or byte code without running it, so insecure patterns such as unvalidated input reaching a query, hard-coded secrets or unsafe memory handling are found in the developer's own code well before a build is released. Probing a running instance requires a deployed application and is dynamic testing. Matching named libraries against public defect lists finds flaws already published by someone else. Monitoring live servers reports on software that is already exposed.

116. In a CySA+ vulnerability management report, which element communicates the relative urgency of remediating a specific finding to stakeholders?
     • The severity score derived from the CVSS base metrics
     • The MAC address burned into the affected network card
     • The build number stamped on the installed scan engine
     • The complete tally of unfiltered TCP ports per device

     Correct answer: The severity score derived from the CVSS base metrics

     A severity score derived from the common vulnerability scoring system converts a technical finding into a comparable measure of exploitability and impact, which is what lets a reader rank one finding against another and decide what to fix first. A hardware address identifies an interface but says nothing about consequence. The engine build tells the reader which tool produced the result. A tally of unfiltered ports describes attack surface without weighting how dangerous any single exposure is.

117. An analyst is preparing a vulnerability report and notices the same critical finding reappears on a host after each monthly scan. Which reporting element best captures this?
     • Escalation
     • Compliance
     • Mitigation
     • Recurrence

     Correct answer: Recurrence

     A finding that disappears and then returns on the next scan is recorded as a recurrence, and reporting it that way tells the reader the fix did not hold: the patch was rolled back by a rebuild, an image was redeployed from an old template, or the change was never made permanent. Escalation describes raising an unresolved item to a higher authority. Compliance maps a finding to a regulation or framework. Mitigation describes the treatment applied. Only recurrence captures the same defect appearing again.

118. A service-level agreement (SLA) requires critical vulnerabilities to be remediated within 15 days, but a legacy industrial system cannot be patched without halting production. What is this situation an example of?
     • A compliance report delivered to the audit committee
     • A false positive confirmed during the analyst review
     • A remediation inhibitor entered in the risk register
     • A zero-day exploit detailed inside a vendor advisory

     Correct answer: A remediation inhibitor entered in the risk register

     Anything that prevents a fix being applied inside the agreed window is an inhibitor to remediation: legacy or unsupported platforms, degrading functionality, memorandums of understanding, and the business interruption that patching a production line would cause. Inhibitors are documented so the risk owner can accept the residual risk or fund a compensating control. A compliance report is an output, not an obstacle. A false positive means the finding was never real. A zero-day describes a defect with no fix yet available, which is not the situation here.

119. When a vulnerability cannot be immediately patched due to business constraints, which action plan element reduces risk in the interim?
     • Adding a compensating control around the exposed system
     • Recording a written risk acceptance inside the register
     • Rescanning the host with credentials to verify findings
     • Requesting a deadline extension from the business owner

     Correct answer: Adding a compensating control around the exposed system

     A compensating control is the interim treatment: segmenting the host, restricting who can reach the service, adding stricter monitoring or virtual patching lowers the likelihood or the impact of exploitation while the underlying defect is still present. Recording an acceptance documents the exposure but leaves it exactly as it was. Rescanning with credentials verifies the finding and changes nothing about it. Extending a deadline moves the paperwork rather than the risk, so only the added control reduces exposure in the meantime.

120. Which of the following is a key performance indicator (KPI) commonly tracked in vulnerability management reporting?
     • The mean time between two unplanned data centre outages
     • The mean time required to remediate a reported weakness
     • The mean time a helpdesk ticket remains completely open
     • The mean time an analyst spends per unresolved incident

     Correct answer: The mean time required to remediate a reported weakness

     Mean time to remediate measures the interval between a vulnerability being discovered and the fix being verified, and tracking it over time shows whether the programme is getting faster and whether the agreed service levels are being met. Mean time between outages is a reliability measure for infrastructure availability. Ticket duration reports on service desk throughput. Analyst handling time measures workload in the operations centre. All are real metrics, but only remediation time reflects vulnerability management performance.

121. A security manager asks for a report showing the most prevalent weaknesses across the environment so leadership can focus resources. Which metric best satisfies this request?
     • A per-host inventory of the open service ports found
     • A chronological log of the scanner task launch times
     • A copy of the untouched XML assessment output record
     • A ranked list of the weaknesses seen most frequently

     Correct answer: A ranked list of the weaknesses seen most frequently

     Ranking findings by how frequently they appear and how much risk each carries tells leadership where a single fix removes the largest amount of exposure, which is exactly the prioritisation a resourcing decision needs. A port inventory describes attack surface host by host without showing what is common across the estate. A log of task launch times reports on tool operations. Untouched assessment output is the underlying evidence, unaggregated and unreadable for an audience deciding where to spend.

122. What does a Service-Level Objective (SLO) define in the context of vulnerability management metrics?
     • The contractual penalty a supplier owes for repeated failures
     • The maximum data loss permitted during a prolonged disruption
     • The proportion of production systems a scanner reached lately
     • The measurable target used to gauge the programme performance

     Correct answer: The measurable target used to gauge the programme performance

     A service-level objective is the specific, measurable target a programme holds itself to, such as remediating critical findings inside an agreed number of days, and performance is reported against it to show whether commitments are being met. A penalty owed for repeated failures is a contractual remedy, not a target. A tolerance for data loss is a recovery point objective used in continuity planning. Scanner coverage is a useful metric, but it measures reach rather than setting the standard being measured against.

123. Why is it important to identify the correct stakeholders when distributing a vulnerability or incident report?
     • So the retention schedule for audit evidence is satisfied
     • So each audience receives detail matched to its decisions
     • So the finished summary is encrypted before it circulates
     • So the wording matches the approved corporate style guide

     Correct answer: So each audience receives detail matched to its decisions

     Reports are written for people who have to act, and different readers act on different things: executives need business risk and cost, engineers need affected hosts and remediation steps, legal and compliance need regulatory exposure. Identifying the stakeholders first is what lets the writer pitch content at the right level for each. Meeting a retention schedule and encrypting the document before it moves are handling requirements that apply whoever receives it, and matching a house style changes presentation rather than substance.

124. An executive audience is reading a security report. Which section is specifically written for them?
     • The appendix describing the scan procedures in full detail
     • The table listing each defect beside its remediation steps
     • The opening summary of business exposure for the directors
     • The log of evidence caught during ongoing exploit attempts

     Correct answer: The opening summary of business exposure for the directors

     An executive summary is written for readers who make funding and risk-acceptance decisions, so it states the business consequence, the exposure that matters most and the recommended course of action in plain language, with the technical substantiation left to the body of the report. A methodology appendix documents how the assessment was run. A per-defect table is written for the engineers who will apply the fixes. An evidence log supports verification and is the least suitable material for a leadership audience.

125. Which type of report demonstrates that an organization meets the requirements of a regulation or standard such as PCI DSS or HIPAA?
     • A vulnerability report that grades findings by risk exposure
     • A penetration test report that documents the exploited paths
     • A compliance report that maps controls to regulatory clauses
     • A forensic timeline report that orders the observed activity

     Correct answer: A compliance report that maps controls to regulatory clauses

     A compliance report is the artefact that maps an organisation's implemented controls and remediation evidence back to the clauses of a named rule set such as PCI DSS or HIPAA, which is what an auditor or regulator asks to see. A vulnerability report ranks technical findings by risk but proves nothing about a regulatory clause. A penetration test report documents which attack paths succeeded, not which requirements are satisfied. A forensic timeline orders events during an investigation and belongs to incident response rather than to demonstrating conformance.

126. During incident response, which activity formally notifies leadership and triggers the response process based on defined criteria?
     • Declaring the incident once a threshold is crossed
     • Imaging the affected disk to preserve the evidence
     • Rebuilding the compromised host from a clean image
     • Rehearsing the response plan in a tabletop session

     Correct answer: Declaring the incident once a threshold is crossed

     Incident declaration is the formal act of stating that an event has crossed the documented criteria and is now an incident, which is what activates the plan and the notification chain up to leadership. Disk imaging is an evidence-handling task carried out after the response is already running. Rebuilding a compromised host belongs to eradication and recovery, well past the point where leadership was notified. A tabletop drill is a preparation activity rehearsed before any real event, and it triggers nothing.

127. An analyst identifies that a contained incident now involves regulated customer data and possible legal exposure. What is the appropriate next communication step?
     • Notify the whole customer base through the open status page
     • Send the raw evidence over to the software vendor's experts
     • Prepare the service desk staff so they can answer questions
     • Escalate to the legal team along the defined response route

     Correct answer: Escalate to the legal team along the defined response route

     Once regulated data and legal exposure are in scope, the correct communication step is to move the incident up the documented path so counsel and executive decision makers own the disclosure question. Notifying customers directly through a public page pre-empts that decision and can create liability before counsel has assessed the breach. Sending raw evidence outside the organisation risks spoliation and uncontrolled disclosure. Briefing the service desk prepares call handling but leaves the people who must decide on notification uninformed.

128. What is the primary purpose of a root cause analysis (RCA) during post-incident activity?
     • To quantify how long the whole analysis phase genuinely ran
     • To understand the root cause so the incident cannot reoccur
     • To prove the eradication step really cleared the rogue code
     • To rank the residual risk the recovered asset still carries

     Correct answer: To understand the root cause so the incident cannot reoccur

     Root cause analysis exists to reach the condition that allowed the incident, such as an unpatched service or a process gap, so the fix removes the class of failure rather than the symptom. Measuring how long analysis ran is a metric exercise that describes effort, not causation. Confirming eradication worked is a verification step that shows the threat is gone but says nothing about why it got in. Ranking residual risk on the recovered asset is a risk management output that assumes the cause is already understood.

129. When are 'lessons learned' meetings most appropriately conducted in the incident response life cycle?
     • During the preparation phase, after the playbook is approved
     • During the containment phase, after the endpoint is isolated
     • During the post-incident phase, after the recovery work ends
     • During the detection phase, after the alerts are prioritised

     Correct answer: During the post-incident phase, after the recovery work ends

     Lessons-learned reviews belong to the post-incident phase, held once recovery is complete and the facts are settled, so the team can judge what worked and feed changes into playbooks, tooling and training. Holding one in preparation would review an event that has not happened. Holding one during containment pulls responders away while the threat is still live and the picture is incomplete. Holding one at detection is earlier still, when scope and impact are unknown and no response has yet been carried out to review.

130. Which metric best communicates how quickly a SOC identifies an active incident?
     • Mean time to restore a platform after a disruption
     • Mean time to detect an intrusion already under way
     • Mean time between the failures of a single machine
     • Mean time to distribute a patch across the network

     Correct answer: Mean time to detect an intrusion already under way

     Mean time to detect measures the gap between the start of malicious activity and the moment the team identifies it, so it speaks directly to how fast a SOC spots an incident. Mean time to restore measures recovery speed once the outage is already known, which is a later stage. Mean time between failures is a reliability measure for equipment and has no bearing on detection. Mean time to deploy a patch measures remediation throughput in vulnerability management rather than detection capability.

131. Why should incident reports and sensitive vulnerability findings be distributed through secure channels?
     • To keep exploitable details out of an attacker's hands
     • To route the report into the patch remediation backlog
     • To safeguard the chain of custody over seized evidence
     • To meet the retention window the records team enforces

     Correct answer: To keep exploitable details out of an attacker's hands

     Incident reports and vulnerability findings name weak systems, missing patches and response gaps, so an adversary who intercepts one gains a ready-made target list; encryption, access control and need-to-know distribution exist to stop that. Routing a report into the remediation queue is a workflow step that says nothing about who else can read it. Chain of custody governs how evidence is handled for legal defensibility, not how a report is transmitted. Retention rules dictate how long a record is kept, not who may see it in transit.

132. A regulation requires notifying affected individuals within a fixed time window after a confirmed data breach. Which reporting consideration does this represent?
     • A compensating control logged in the local risk register
     • A tracking metric the remediation team checks each month
     • A standing advisory released by an industry threat group
     • A legal reporting duty imposed by the governing statutes

     Correct answer: A legal reporting duty imposed by the governing statutes

     A fixed deadline to notify affected individuals after a confirmed breach is a mandatory obligation created by law or regulation, so the analyst must give legal and compliance the facts they need to meet the clock. A compensating control is an alternative safeguard used when a required control cannot be implemented; it compels no notification. A tracking metric describes how the programme performs over time and carries no external obligation. An industry advisory is guidance an organisation can choose to follow, not a binding notification requirement.

133. When communicating with non-technical executives versus the technical operations team about the same vulnerability, the analyst should primarily adjust which aspect of the message?
     • The severity score and the scanning tool identified in the report
     • The technical depth and the business framing of the whole message
     • The asset inventory and the exposure timing stated in the finding
     • The repair deadline and the owning team registered on each ticket

     Correct answer: The technical depth and the business framing of the whole message

     Audience-appropriate communication keeps the facts identical and changes only how much technical depth is presented and how the consequence is framed, so executives hear risk, cost and business impact while operations hears the technical remediation detail. The severity score and the tool that produced it are findings of record and must not shift with the audience. The affected asset list and the date exposure began are factual and equally fixed. The remediation deadline and the accountable owner are commitments that stay the same no matter who is briefed.

134. A SOC analyst is reviewing firewall connection logs and notices that an internal workstation opens a small outbound HTTPS connection to the same external IP address every 60 seconds, give or take a few seconds, around the clock with very little data transferred each time. Which malicious activity does this pattern most strongly indicate?
     • Exfiltrating archived data away over an encrypted upload pipeline
     • Spraying reused passwords across the whole domain controller pool
     • Beaconing to the attacker-run control server at regular intervals
     • Tunnelling the stolen records inside crafted name lookup requests

     Correct answer: Beaconing to the attacker-run control server at regular intervals

     Small, low-volume outbound sessions to one fixed destination at a near-constant interval with slight jitter is the signature of malware checking in with its command-and-control infrastructure for instructions. Bulk exfiltration would show large sustained transfers rather than a few bytes each cycle. Password spraying is an authentication pattern aimed at many accounts and would surface in logon telemetry, not as a single repeating outbound session. Smuggling data inside name resolution traffic would appear on resolver traffic and would also move far more data than this pattern shows.

135. After a phishing victim's laptop is compromised, the attacker uses the victim's harvested domain credentials to authenticate to several other internal servers over SMB and RDP, expanding access without deploying new malware. In the MITRE ATT&CK framework, this behavior is best categorized as which tactic?
     • Lateral movement, reusing stolen accounts to reach other hosts
     • Credential access, dumping the secrets cached in browser files
     • Privilege escalation, exploiting a defect to gain admin rights
     • Persistence, installing a startup service to survive a restart

     Correct answer: Lateral movement, reusing stolen accounts to reach other hosts

     Lateral movement covers an adversary pivoting from an initial foothold to additional systems, classically by reusing stolen valid accounts over built-in remote protocols, which is exactly what the described SMB and RDP authentications are. Credential access describes the earlier theft of those secrets, a step that has already happened here. Privilege escalation is about gaining higher rights on a system rather than reaching more systems. Persistence is about surviving reboots and credential changes, and the scenario states that no new malware or foothold was planted.

136. A security team wants to reduce analyst workload by automatically enriching alerts, querying threat intelligence, and executing predefined containment playbooks when a high-confidence detection fires. Which technology is specifically designed to orchestrate and automate these response workflows across multiple security tools?
     • SIEM, which correlates the alerts many security tools generate
     • EDR, which records the process behaviour of enrolled endpoints
     • CASB, which mediates staff access to sanctioned cloud services
     • SOAR, which chains the response playbooks over vendor consoles

     Correct answer: SOAR, which chains the response playbooks over vendor consoles

     Security orchestration, automation and response is the platform category built to connect separate products, run codified playbooks against them and carry out enrichment or containment automatically once a high-confidence detection fires. A SIEM aggregates and correlates telemetry to raise the detection but does not execute cross-product response. An EDR agent inspects and can contain a single endpoint, so its reach stops at the host. A cloud access security broker governs how users reach cloud services and orchestrates nothing across the wider tool set.

137. An analyst is explaining the difference between an indicator of compromise (IoC) and an indicator of attack (IoA) to a junior teammate. Which statement correctly distinguishes the two?
     • An IoC is a behaviour signature; an IoA is a stored artefact
     • An IoC names the threat actor group; an IoA rates the damage
     • An IoC is proof a breach occurred; an IoA shows early intent
     • An IoC is a vendor detection alert; an IoA is scanner output

     Correct answer: An IoC is proof a breach occurred; an IoA shows early intent

     An indicator of compromise is forensic residue proving an intrusion already took place, such as a malicious hash, a callback address or a rogue registry key, while an indicator of attack describes adversary behaviour and objective while the operation is still unfolding, which is what allows detection before the damage lands. Reversing the two mislabels post-event artefacts as live behaviour. Neither term identifies a threat actor group or scores impact; that is attribution and impact analysis. Neither is a vendor detection alert or a scanner output, which are tooling products rather than indicator classes.

138. A malware analyst needs to extract the behavior of a suspicious executable, including the network connections it makes and the files it drops, but wants to do so without studying its raw code line by line. Which analysis approach should the analyst use, and where should it be performed?
     • Dynamic analysis, by detonating the sample inside a sealed sandbox
     • Dynamic analysis, by attaching a debugger on the analyst's machine
     • Static analysis, by disassembling the binary within a code browser
     • Static analysis, by comparing the file hash against threat records

     Correct answer: Dynamic analysis, by detonating the sample inside a sealed sandbox

     Running the sample and watching what it does is dynamic analysis, and doing it in an isolated, instrumented sandbox is what safely yields the dropped files, spawned processes and outbound callbacks the analyst wants. Attaching a debugger on a working laptop is still dynamic but places live malware on a production-connected machine with no containment. Disassembling the binary is static analysis and means reading code line by line, the very thing the analyst wants to avoid. Comparing a hash against threat feeds is a static reputation lookup that reveals no behaviour at all.

139. A security analyst references CVE-2024-XXXXX in a remediation ticket. What does a CVE identifier actually represent?
     • A severity grade produced by a public open score formula
     • A unique global name tied to one disclosed software flaw
     • A catalogue of flaws confirmed to be under active attack
     • A class of source weakness outlined in a shared taxonomy

     Correct answer: A unique global name tied to one disclosed software flaw

     A Common Vulnerabilities and Exposures identifier is a catalogue entry: one unambiguous public name for a specific disclosed flaw, so that vendors, scanners and analysts all refer to the same thing. The numeric severity grade comes from CVSS, a separate scoring framework. The list of flaws under active exploitation is a distinct catalogue maintained for prioritisation, not an identifier scheme. A class of weakness is what CWE describes, a taxonomy of flaw types rather than a name for one concrete instance.

140. An analyst is explaining the difference between CVE and CVSS to a junior teammate. Which statement is correct?
     • CVE gives a flaw its severity range; CVSS gives it a plain marker
     • CVE gives a flaw an exploited status; CVSS gives it the fix state
     • CVE gives a flaw its own fault type; CVSS gives the product label
     • CVE gives a flaw its unique name; CVSS measures how serious it is

     Correct answer: CVE gives a flaw its unique name; CVSS measures how serious it is

     The two schemes do different jobs: CVE assigns one unique identifier to a specific disclosed flaw so everyone can name it the same way, while CVSS produces a numeric severity score from defined metrics so findings can be compared and ranked. Swapping the two roles inverts the relationship and is the most common confusion. Neither scheme records whether a flaw is under exploitation or whether a vendor fix exists; those are separate catalogues. Neither one names weakness categories or affected products, which are the jobs of a weakness taxonomy and an asset inventory.

141. A vulnerability has a CVSS v3.1 base score of 7.4. Which qualitative severity rating does that score fall into?
     • High, a grade that demands a fast remediation push
     • Low, a verdict that owners accept as residual risk
     • Medium, a score that fits the ordinary patch cycle
     • Critical, a flaw that most teams call an emergency

     Correct answer: High, a grade that demands a fast remediation push

     Under the CVSS version 3.1 qualitative scale a base score of 7.4 sits in the High band, which runs from 7.0 to 8.9. It is above the Medium band, which stops at 6.9, and below the Critical band, which starts at 9.0, so neither of those labels applies. The Low band tops out at 3.9 and is far below this score. Translating a raw number into the right band matters because remediation timelines in most policies are written against the band rather than the decimal.

142. Which set of values correctly maps CVSS v3.1 base scores to their qualitative severity labels?
     • 0.1-2.9 Low, 3.0-5.9 Medium, 6.0-8.9 High, 9.0-10.0 Critical
     • 0.1-4.9 Low, 5.0-7.9 Medium, 8.0-9.4 High, 9.5-10.0 Critical
     • 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical
     • 0.1-3.9 Low, 4.0-7.9 Medium, 8.0-8.9 High, 9.0-10.0 Critical

     Correct answer: 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical

     The published CVSS version 3.1 qualitative severity ranges are 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High, and 9.0 to 10.0 Critical, with a score of exactly zero rated None. Every other mapping shown here shifts one or more of those boundaries, so a score would be labelled a band too high or a band too low. Knowing the real boundaries lets an analyst convert a raw base score into the wording used in policy, ticket priorities and executive reporting without looking it up.

143. What does the CVSS base score group specifically measure about a vulnerability?
     • The maturity of public exploit code and the state of fixes
     • The stable traits of the flaw itself and its direct impact
     • The value of the affected asset and the controls around it
     • The chance the issue gets exploited and the pace of spread

     Correct answer: The stable traits of the flaw itself and its direct impact

     Base metrics capture the qualities of a vulnerability that do not change with time or with where it is deployed: attack vector, attack complexity, privileges required, user interaction, scope, and the confidentiality, integrity and availability impact. How mature public exploit code is and whether a vendor fix exists are temporal factors that shift week by week. How valuable the affected asset is and what compensating controls surround it are environmental factors specific to one deployment. The probability of exploitation in a coming window is a threat-driven estimate produced outside the base group entirely.

144. A CVSS vector string for a flaw shows the Attack Vector metric as Network (AV:N). What does this indicate?
     • The flaw can be reached from an adjacent subnet gateway
     • The flaw can be reached from a live interactive session
     • The flaw can be reached from the physical device itself
     • The flaw can be reached from any routable network route

     Correct answer: The flaw can be reached from any routable network route

     An attack vector of Network means the vulnerable component is bound to the network stack and can be attacked from an arbitrary routable distance, up to and including the open internet, with no local or physical foothold. Reachability limited to the same broadcast segment is the Adjacent value. Needing an existing session on the target first is the Local value. Needing to physically handle the hardware is the Physical value, the most constrained of the four and the one that scores lowest for exploitability.

145. When manually deriving a CVSS v3.1 score, which inputs feed the Exploitability sub-score of the base metric group?
     • The Confidentiality, Integrity and Availability impacts with Scope changes
     • Exploit Code Maturity, Remediation Level and Report Confidence assessments
     • Attack Vector, Attack Complexity, Privileges Required and User Interaction
     • Asset criticality, deployment context and the in-place mitigation strength

     Correct answer: Attack Vector, Attack Complexity, Privileges Required and User Interaction

     The exploitability sub-score of the base group is built from attack vector, attack complexity, privileges required and user interaction, the four metrics describing how hard the flaw is to reach and to trigger. The confidentiality, integrity and availability impacts, together with any change of scope, feed the separate impact sub-score instead. Exploit code maturity, remediation level and report confidence belong to the temporal group and adjust an already published base score. Asset criticality, deployment context and the mitigations already in place belong to the environmental group, which tailors a score to one site.

146. Which CVSS metric group adjusts a base score over time based on factors like exploit code maturity and patch availability?
     • Temporal metrics, which track how the threat picture develops
     • Base metrics, which represent the flaw's own fixed properties
     • Environmental metrics, which weigh one site's own local setup
     • Impact metrics, which quantify the damage one breach inflicts

     Correct answer: Temporal metrics, which track how the threat picture develops

     The temporal group exists to move a score as real-world conditions change, using exploit code maturity, remediation level and report confidence, so a flaw whose proof-of-concept becomes a weaponised exploit or whose vendor patch ships is rescored accordingly. Base metrics are deliberately fixed and describe the flaw itself. Environmental metrics adjust for one organisation's asset value and compensating controls rather than for the passage of time. The impact metrics measure the damage a successful exploit causes and sit inside the base group.

147. An organization wants its CVSS scores to reflect that a vulnerable server holds highly sensitive data and sits behind strict network segmentation. Which CVSS metric group should it apply?
     • Temporal metrics, which follow how the exploit code ages
     • Environmental metrics, which retune a score for one site
     • Base metrics, which stay fixed wherever the flaw appears
     • Impact metrics, which weigh the damage a breach produces

     Correct answer: Environmental metrics, which retune a score for one site

     Environmental metrics let an organisation restate a published score for its own deployment, raising it where the asset carries highly sensitive data through the security requirement metrics and lowering it where controls such as strict segmentation reduce exposure through the modified base metrics. Temporal metrics track how the wider threat and fix picture evolve, not local asset value. Base metrics are constant by design and cannot express local context. The impact metrics sit inside the base group and describe generic damage, not this organisation's own stakes.

148. A vulnerability management program follows a repeatable lifecycle. Which sequence best represents the vulnerability management lifecycle?
     • Contain the threat, wipe it out, restore work, then debrief
     • Probe the target, load a payload, transmit it, then exploit
     • Gather the needs, design a plan, ship it, then decommission
     • Discover the assets, rank each flaw, fix them, then confirm

     Correct answer: Discover the assets, rank each flaw, fix them, then confirm

     Vulnerability management is a continuous loop: enumerate and scan the estate, analyse and prioritise what the scan returns, remediate or mitigate according to that priority, then verify the fix held and report the result before the cycle repeats. Containment, eradication, recovery and a debrief describe the incident response life cycle, which begins only once something has already gone wrong. Reconnaissance through exploitation describes an attacker's kill chain. Requirements through decommissioning describes a system development life cycle, not the handling of findings.

149. What is the primary purpose of a vulnerability scan?
     • To list the known weaknesses on each machine so they get ranked
     • To watch the live traffic for signs of an active hostile attack
     • To exploit a weakness so the real business impact is proven out
     • To encrypt the archives at rest so a thief cannot decipher them

     Correct answer: To list the known weaknesses on each machine so they get ranked

     A vulnerability scan systematically enumerates known weaknesses such as missing patches, weak configurations and unsupported software across the estate, producing a catalogue that can then be prioritised and remediated. Watching live traffic for attack signatures is what an intrusion detection sensor does, and it finds attacks in progress rather than latent weaknesses. Exploiting a weakness to demonstrate real impact is penetration testing, which goes well beyond what a scan is authorised to do. Encrypting data at rest is a protective control and detects nothing.

150. A credentialed (authenticated) vulnerability scan differs from a non-credentialed scan primarily in that it:
     • It launches far more probes per second to map the open ports
     • It reads a mirror of the traffic rather than touch the hosts
     • It signs in with a valid credential to check the patch state
     • It drops a tiny local scan agent onto the target host itself

     Correct answer: It signs in with a valid credential to check the patch state

     A credentialed scan authenticates to the target and inspects installed software, patch state and configuration from the inside, which is why it returns far more accurate results and far fewer unconfirmed findings than an unauthenticated view of the same host. Sending more probes faster describes scan intensity, which is independent of whether credentials are supplied. Reading mirrored traffic instead of touching hosts describes passive scanning. Installing a local agent describes agent-based scanning, a different collection model that needs no interactive logon at scan time.

151. An analyst runs a non-credentialed scan against a web server and the report flags many findings as potential but unconfirmed. Why does a non-credentialed scan tend to produce this kind of result?
     • It polls the vendor feed on a lengthy delay, so its data lags weekly
     • It runs a local agent on a timetable, so it skips the periodic check
     • It probes at a slow rate by design, so it overlooks the silent hosts
     • It must infer the flaw from a banner, so it guesses the patch status

     Correct answer: It must infer the flaw from a banner, so it guesses the patch status

     Without credentials a scanner sees only what a service exposes externally, so it reasons from banners, response behaviour and version strings and cannot read the actual patch state, which is why so many findings come back as potential rather than confirmed and why false positives rise. A non-credentialed scan does not depend on a vendor feed refresh cycle. It runs no local agent, so agent scheduling cannot explain the result. Scan rate affects coverage and timing, not whether a finding can be confirmed.

152. A team needs continuous visibility into endpoints that frequently disconnect from the corporate network. Which scanning approach is best suited, and why?
     • Agentless remote scanning, which contacts hosts during that scan window
     • Agent-based scanning, which reports back once a roaming host reconnects
     • Passive network scanning, which reads whatever the mirrored flows carry
     • Cloud connector scanning, which harvests inventory through a broker API

     Correct answer: Agent-based scanning, which reports back once a roaming host reconnects

     A locally installed agent keeps collecting vulnerability and configuration data while the endpoint is away from the corporate network and uploads its results the next time the device connects, which is the only model giving continuous coverage of roaming laptops. Agentless remote scanning can assess a host only if it happens to be reachable during the scan window. Passive collection from mirrored traffic sees a device only while it is generating traffic on the monitored segment. A cloud connector reads a provider's inventory and never reaches a roaming corporate endpoint.

153. A SOC wants to discover vulnerable systems without sending any probe packets that might disrupt fragile operational technology devices. Which technique meets this requirement?
     • Passive scanning that fingerprints systems from a mirrored data tap
     • Aggressive port scanning that pushes probe traffic at fragile hosts
     • Active fuzz scanning that drives malformed frames into a controller
     • Credentialed scanning that signs in to each separate managed device

     Correct answer: Passive scanning that fingerprints systems from a mirrored data tap

     Passive scanning derives an inventory and infers weaknesses purely from a copy of network traffic taken off a mirror or tap, so it transmits nothing towards the operational technology devices and cannot knock a fragile controller offline. Aggressive port scanning opens connections to the devices themselves and is a known cause of outages in industrial environments. Fuzzing deliberately sends malformed input to provoke faults, which is the opposite of safe here. A credentialed scan authenticates to each device and still generates traffic against it.

154. What distinguishes active vulnerability scanning from passive vulnerability scanning?
     • Active scanning taps the copied flows; passive scanning emits the packets
     • Active scanning needs an agent deployed; passive scanning simply does not
     • Active scanning pushes probes at a target; passive scanning just observes
     • Active scanning reads config files; passive scanning reads the audit data

     Correct answer: Active scanning pushes probes at a target; passive scanning just observes

     The dividing line is whether traffic is generated: active scanning transmits crafted requests to the target and interprets the responses, while passive scanning listens to traffic that already exists and infers what it can from it. Describing active scanning as the listener and passive scanning as the injector reverses the two techniques. Neither is defined by whether an agent is installed, since agent-based and agentless collection cut across both. Neither is defined by reading configuration files or log files, which describes file-based auditing rather than this distinction.

155. In vulnerability scanning, what is a false positive?
     • A gap the scan missed while enumerating the same exposed web server
     • A signal the tool confirmed by exploiting the fault it had reported
     • A result the owner closed by duly accepting the leftover known risk
     • A finding the scanner published for a flaw missing from the machine

     Correct answer: A finding the scanner published for a flaw missing from the machine

     A false positive is a reported vulnerability that is not actually present, for example a version banner that looks vulnerable when the vendor has back-ported the fix without changing it, and validating findings is what keeps analysts from spending remediation effort on nothing. A weakness the scan failed to report although it was present is a false negative, the more dangerous opposite. A finding proven real by exploitation is a true positive. A finding closed because the organisation has formally accepted the risk is a risk acceptance decision, not a scanner error.

156. An analyst is comparing two scan errors. Which statement correctly contrasts a false positive with a false negative?
     • A false positive ignores a verified defect, while a false negative invents a fictional defect
     • A false positive reports a phantom weakness, while a false negative misses a genuine weakness
     • A false positive overstates a real finding, while a false negative understates a real finding
     • A false positive follows a credentialed scan, while a false negative follows a discovery scan

     Correct answer: A false positive reports a phantom weakness, while a false negative misses a genuine weakness

     A false positive is a finding the scanner reports when the weakness is not actually present, and a false negative is a real weakness the scanner fails to report at all. False positives cost analyst hours on non-issues; false negatives are the more dangerous error because a live exposure stays unremediated. Reversing the two definitions describes the opposite pair of errors. Overstating or understating a proven finding is a severity-scoring problem, not a detection error, since the flaw was correctly found either way. And both error types occur in credentialed and unauthenticated discovery scans alike, so scan mode does not define which error is which.

157. A scanner reports a critical vulnerability on a server, but the analyst confirms the patch was actually applied via a vendor backport that did not change the version banner. How should this finding be classified and handled?
     • As a true positive needing this instant patch reapplication
     • As a false negative needing a repeated credentialed recheck
     • As a true negative needing no further analyst investigation
     • As a false positive needing a validated scanner suppression

     Correct answer: As a false positive needing a validated scanner suppression

     The fix is already on the box: the vendor backported it without advancing the version banner, so the scanner inferred a flaw from the banner alone and reported something that does not exist. That is a false positive, and the correct handling is to validate the result against the package changelog, document the rationale, and tune or suppress the signature so the noise does not return next cycle. Calling it a true positive would send engineers to reinstall a patch that is already applied. A false negative is the opposite error, a real flaw the scan missed, which would call for a deeper scan rather than suppression. A true negative would mean the scanner correctly reported nothing, but here it reported a critical.

158. Three vulnerabilities all have a CVSS base score of 9.0. One appears in the CISA Known Exploited Vulnerabilities (KEV) catalog and has a high EPSS probability. Under risk-based prioritization, how should the analyst rank it?
     • Remediate it urgently, since the active exploitation lifts the real risk
     • Rank it evenly, since the published score covers the likely exploitation
     • Defer it briefly, since the catalog listing confirms the released repair
     • Rank it lowest, since the prediction score outranks the severity metrics

     Correct answer: Remediate it urgently, since the active exploitation lifts the real risk

     Risk-based prioritization puts the catalog-listed, high-probability vulnerability at the top because confirmed exploitation in the wild plus a high predicted likelihood of attack raise its real-world risk well above two peers with identical inherent severity. The base score measures inherent severity only and deliberately excludes any threat or exploitation evidence, so it cannot separate the three by itself. A catalog listing is evidence that attackers are using the flaw now, not a reason to wait, even though remediation guidance exists. And exploitation probability supplements severity rather than replacing it; the two are combined with asset criticality, never ranked one above the other.

159. What is the primary goal of patch management within a vulnerability management program?
     • To watch correlated alerts so active intrusions surface far quicker
     • To probe listening ports so unknown services become clearly indexed
     • To deploy verified vendor updates so known defects become corrected
     • To encrypt stored records so lost media stays completely unreadable

     Correct answer: To deploy verified vendor updates so known defects become corrected

     Patch management exists to acquire, test, and roll out vendor updates through a controlled and documented process so that known software defects are actually removed before an attacker reaches them. Staging the update in a test environment first is what keeps the fix from breaking production. Alert correlation is detection work and surfaces an intrusion that is already under way; it closes no code defect. Port probing is discovery and inventory work that tells you what is exposed but changes nothing about the flaw. Encrypting data at rest protects confidentiality if media is lost and leaves the vulnerable software exactly as vulnerable as before.

160. A critical vulnerability is found on a legacy system that cannot be patched without breaking a required business application. Which response is the best example of a compensating control?
     • Documenting the exception in the governance records with owner signoff
     • Applying the patches in the scheduled maintenance window with downtime
     • Logging the finding in the central register with remediation deadlines
     • Isolating the legacy machine in the restricted segment with monitoring

     Correct answer: Isolating the legacy machine in the restricted segment with monitoring

     A compensating control is an alternative safeguard that lowers exposure when the primary fix cannot be applied, and isolating the legacy machine inside a restricted segment under closer monitoring is exactly that: the flaw remains, but reachability collapses. Segmentation, virtual patching at a web application firewall or intrusion prevention sensor, and tightened access rights are the usual forms. Documenting the exception in a governance record with owner signoff is risk acceptance, a decision that changes no technical exposure. Applying the vendor patch is the primary remediation, and the stem rules it out because it breaks the required business application. Logging the finding in a register with a remediation deadline is tracking, which schedules work rather than reducing risk in the meantime.

161. A web application accepts a username field and passes it directly into a database query. An attacker enters input that closes the intended query and appends their own statement, returning all rows from the users table. What attack is this, and what is the best prevention?
     • SQL injection, stopped by binding parameterized database statements
     • LDAP injection, stopped by escaping distinguished directory entries
     • Command injection, stopped by strictly allowlisting shell arguments
     • Cross-site scripting, stopped by contextual browser output encoding

     Correct answer: SQL injection, stopped by binding parameterized database statements

     Untrusted input is concatenated straight into a database query, letting the attacker terminate the intended statement and append one of their own that returns every row of the users table. That is SQL injection, and the strongest defense is prepared parameterized statements, which bind input as data so it can never be parsed as query syntax, backed by input validation and a least-privilege database account. LDAP injection abuses directory filter syntax and is escaped at the distinguished name, not the database. Command injection abuses an operating system shell and is contained by allowlisting arguments. Cross-site scripting is defeated by encoding output in the browser, which does nothing to the query the database parses.

162. An analyst reviews web server logs and sees repeated requests containing strings like ' OR '1'='1, UNION SELECT, and a comment marker after the input. What does this pattern most likely indicate?
     • Directory traversal probing aimed at fetching files outside webroot
     • Credential stuffing probing aimed at reusing breached SSO passwords
     • SQL injection probing aimed at controlling backend database queries
     • Cross-site scripting probing aimed at sending scripts into browsers

     Correct answer: SQL injection probing aimed at controlling backend database queries

     A tautology that always evaluates true, a UNION clause bolted onto an existing SELECT, and a trailing comment marker that truncates the rest of the original statement are the three canonical fingerprints of someone testing whether a parameter reaches the database unfiltered. Log review for these patterns pairs with web application firewall signatures and source review to confirm the exposure. Directory traversal leaves dot-dot-slash sequences and absolute paths, not query syntax. Credential stuffing shows as high-volume authentication attempts from many accounts, not as clauses inside a parameter. Cross-site scripting payloads carry script tags and event handlers meant for the browser, not query operators meant for the parser.

163. What is cross-site scripting (XSS)?
     • An attack that captures traffic flowing past nearby network relays
     • An attack that injects active script inside innocent user browsers
     • An attack that inserts crafted clauses inside one database request
     • An attack that floods punishing volume inside one service frontend

     Correct answer: An attack that injects active script inside innocent user browsers

     Cross-site scripting places attacker-controlled script into a page so that it executes in the browser of whoever loads that page, which is what makes session token theft, defacement, and forced redirection possible. Its target is the client, which is why output encoding for the correct context plus a content security policy are the primary defenses. Capturing traffic as it flows past network relays describes an on-path interception attack. Inserting crafted clauses inside a database request describes injection against the backend database engine. Flooding a service frontend with punishing volume until its resources exhaust describes a denial of service, which affects availability and injects nothing into any page.

164. An analyst is categorizing XSS findings. Which set correctly names the main types of cross-site scripting?
     • Persistent, reflected, and DOM-based variants
     • Agent-based, NIDS-based, and cloud collectors
     • Stack-based, heap-based, and NULL dereference
     • Uncredentialed, SNMP-based, and passive scans

     Correct answer: Persistent, reflected, and DOM-based variants

     Cross-site scripting is categorized as persistent, where the payload is stored on the server and served to every later viewer; reflected, where the payload is echoed back from one crafted request; and DOM-based, where client-side script writes attacker input into the page without safe handling. Agent-based, NIDS-based, and cloud collectors are monitoring deployment models, describing where a sensor sits rather than how a script is delivered. Stack-based, heap-based, and NULL dereference faults are memory-corruption classes affecting compiled code, not browser script. Uncredentialed, SNMP-based, and passive collection are vulnerability scanning modes, which describe how findings are gathered.

165. During analysis, an attacker who gained access as a standard user exploits a misconfigured service to gain SYSTEM-level rights. What is this technique called?
     • Lateral movement, reaching the connected servers
     • Defense evasion, concealing the harmful activity
     • Privilege escalation, raising the account rights
     • Credential access, harvesting the stored secrets

     Correct answer: Privilege escalation, raising the account rights

     Gaining rights beyond those originally granted, here jumping from a standard user context to SYSTEM by abusing a misconfigured service, is privilege escalation. Vertical escalation raises the privilege level as it does here; horizontal escalation takes over a different account at the same level. Lateral movement is pivoting from one host to another and does not change the attacker's rights on the machine they already hold. Defense evasion is hiding the activity from controls and logging, which is a separate objective. Credential access is stealing passwords, hashes, or tokens, which may enable escalation later but is not itself the act of elevating permissions on the host.

166. A researcher discovers a flaw in a vendor's product and privately notifies the vendor, agreeing to withhold public details until a patch is released. What practice is this?
     • Full disclosure, publicizing the finding details openly
     • Coordinated disclosure, granting the vendor repair time
     • Zero-day disclosure sales, offering exploits to bidders
     • Black-box testing, evaluating the software from outside

     Correct answer: Coordinated disclosure, granting the vendor repair time

     Reporting the flaw privately and holding back public detail until the supplier can build and ship a fix is coordinated disclosure, often called responsible disclosure, and it usually runs on an agreed embargo window negotiated between the finder and the supplier. Full disclosure publishes everything at once regardless of patch status, which pressures the supplier but leaves users exposed in the meantime, so it is the opposite of the agreement described. Selling the flaw to the highest bidder monetizes it rather than reporting it and leaves users unprotected. Black-box testing is an assessment method describing how a tester works without internal knowledge, and it says nothing about how findings are released.

167. An analyst is documenting an intrusion and wants to capture, for a single malicious event, the actor behind it, the tooling used, the systems that delivered the attack, and the targeted organization. Which analytical model is built around exactly these four core features?
     • The Lockheed Martin Cyber Kill Chain framework
     • The STRIDE model of software threat categories
     • The MITRE ATT&CK matrix of adversary behaviors
     • The Diamond Model of Intrusion Analysis method

     Correct answer: The Diamond Model of Intrusion Analysis method

     The Diamond Model defines a single intrusion event by exactly four core features, adversary, capability, infrastructure, and victim, joined by the edges between them, which is precisely the actor, tooling, delivering systems, and targeted organization the analyst wants to capture. The Cyber Kill Chain is a sequence of attack phases running from reconnaissance to actions on objectives, so it models progression through time rather than the four atomic features of one event. STRIDE is a design-time threat categorization aid built around spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. The MITRE matrix catalogs adversary tactics and techniques rather than defining the feature set of an individual event.

168. A SOC manager explains that the team maintains two kinds of documents: a high-level document describing the overall workflow and decision points for handling a phishing incident, and a separate set of precise step-by-step instructions for the specific commands an analyst runs to pull email headers and quarantine a mailbox. Which pairing correctly matches these descriptions?
     • The overall workflow is the runbook; the precise commands are the playbook
     • The team playbook automates each response; the runbook sets the broad goal
     • The strategic document is the playbook; the command steps form the runbook
     • The playbook is the runbook; the two names describe one identical document

     Correct answer: The strategic document is the playbook; the command steps form the runbook

     A playbook is the strategic layer: the overall workflow, decision points, and escalation paths for handling a whole category of incident such as phishing. A runbook is the operational layer beneath it: the precise, often automatable steps and commands that carry out one part of that response, such as pulling message headers or quarantining a mailbox. Swapping the two labels is the standard trap, because the granular command-level procedure is the runbook and never the strategic overview. Automation also belongs to the runbook layer rather than the playbook, so assigning automated response to the playbook and strategy to the runbook inverts both roles. And the two are not synonyms for one file: they are distinct documents at different levels of detail, which is exactly the distinction the manager drew.

169. A first responder arrives at a compromised but still-powered server and must collect evidence in the correct order of volatility per RFC 3227. Which source should be captured first?
     • The active routing table and the stored address resolution entries
     • The processor register file and the onboard hardware cache entries
     • The document files and directories recorded onto the system volume
     • The offsite archival tapes and disks holding the overnight backups

     Correct answer: The processor register file and the onboard hardware cache entries

     The order of volatility directs a responder to collect the most perishable evidence first, and nothing is more perishable than the processor register file and the onboard hardware cache, whose contents change continuously and vanish the instant power is lost. Routing tables and address resolution entries sit at the next level down, alongside process tables, kernel statistics, and memory, so they are captured second rather than first. Files and directories written to the system volume survive a reboot and are collected later still. Offsite archive media is the least volatile source of all and sits at the end of the sequence, since it changes only when a new backup is written.

170. After a ransomware outage, an executive asks an analyst to distinguish two planning efforts: one focused on keeping critical business functions operating during a disruption, and another focused specifically on restoring IT systems and data after they have failed. Which mapping is correct?
     • Disaster recovery keeps critical functions working; continuity rebuilds affected systems
     • Business continuity covers physical events; disaster recovery covers deliberate breaches
     • Business continuity schedules nightly backups; disaster recovery transfers these offsite
     • Business continuity sustains ongoing services; disaster recovery restores broken systems

     Correct answer: Business continuity sustains ongoing services; disaster recovery restores broken systems

     Business continuity is the broad discipline of keeping the organization's critical functions delivering throughout a disruption, using workarounds, alternate sites, and manual processes as needed. Disaster recovery is the narrower technology effort of bringing failed systems and data back after the failure, and it is normally treated as a subset that supports the continuity goal. Reversing the two assigns the during-the-event role to the recovery plan and the after-the-event role to continuity, which inverts both definitions. Neither discipline is tied to a cause: a ransomware outage and a hurricane both trigger the same planning. And nightly backup scheduling with offsite storage is one supporting control, not the definition of either plan.

171. While mapping observed adversary behavior in MITRE ATT&CK, an analyst notes the attacker's goal was credential access, achieved specifically through brute forcing a login. In ATT&CK terminology, how do these two elements relate?
     • Credential access is the tactic; brute force is the chosen technique
     • Brute force states the goal; credential access states the used means
     • Credential access is one step below brute force; these are sublevels
     • Credential access counts as a procedure; brute force counts the same

     Correct answer: Credential access is the tactic; brute force is the chosen technique

     The framework layers adversary behavior as tactics, techniques, and procedures. Credential access is a tactic, the adversary's objective or the why, and brute force is a technique, the concrete how used to reach that objective. Reversing them makes the goal into a method and the method into a goal, which inverts the hierarchy. Credential access cannot nest below brute force either, because a technique is always the child of a tactic and never its parent. And neither element is a procedure: procedures are the specific implementations a named group uses to carry out a technique, one layer below the technique itself.

172. A SOC manager reports that the team's mean time to respond (MTTR) dropped from 9 hours to 4 hours last quarter. What does this metric actually measure?
     • The average delay counted from intrusion until someone notices
     • The average runtime counted from restart until fresh breakdown
     • The average paperwork counted from closure until report filing
     • The average interval counted from detection until final repair

     Correct answer: The average interval counted from detection until final repair

     Mean time to respond runs from the moment an incident or vulnerability is detected to the moment it is contained or remediated, so a fall from nine hours to four means the team is closing issues in less than half the time it used to need. The clock starts at detection, which is why the period an intruder sits undetected belongs to mean time to detect instead. The span from a restart to the next breakdown is mean time between failures, a reliability measure of hardware and services rather than a response measure. Paperwork produced after an incident closes is documentation effort that falls outside the containment window this metric bounds.

173. Which security metric specifically captures how long a vulnerability or threat exists in the environment before the security team becomes aware of it?
     • Mean time to respond, measured from detection to remediation
     • Mean time between failures, measured from restart to failure
     • Mean time to detect, measured from emergence to notification
     • Mean time to recovery, measured from downtime to restoration

     Correct answer: Mean time to detect, measured from emergence to notification

     Mean time to detect measures how long a threat or vulnerability sits in the environment before the team becomes aware of it, so it is the direct read on how good monitoring and scanning coverage actually are. Continuous scanning and well-tuned correlation rules push it down; quarterly scans and noisy alerting push it up. Mean time to respond starts only once detection has happened and covers containment and remediation, so it measures the work after awareness rather than the delay before it. Mean time between failures is a reliability figure for how long a system runs before it breaks. Mean time to recovery measures how long restoration takes once an outage has begun.

174. A compliance officer asks the analyst to produce a compliance report ahead of an upcoming PCI DSS assessment. What is the primary purpose of such a report?
     • To show the auditors that operating controls satisfy a standard
     • To rank the weaknesses that a scanner identified using severity
     • To record the custodians that a seized evidence exhibit touched
     • To give the responders a scripted checklist that contains steps

     Correct answer: To show the auditors that operating controls satisfy a standard

     A compliance report exists to demonstrate to auditors, regulators, and governance stakeholders that the controls actually deployed satisfy the requirements of a named standard or regulation, and it does that by mapping each control to the criterion it answers. Ranking open findings by severity is the vulnerability report, whose audience is the engineering team doing remediation rather than an assessor. Recording who handled each evidence item is chain of custody documentation, produced during incident response so evidence stays defensible. A scripted checklist of ordered containment steps is a runbook, an operational procedure used while an incident is live rather than a demonstration of control coverage.

175. An incident response lead is asked to reduce the organization's mean time to respond. Which improvement would most directly lower this metric?
     • Extending log retention so investigators can reconstruct historic activity
     • Rehearsing prepared playbooks so responders can start containing instantly
     • Rescanning credentialed subnets so operators can discover exposures sooner
     • Expanding postmortem templates so reviewers can document detailed outcomes

     Correct answer: Rehearsing prepared playbooks so responders can start containing instantly

     Mean time to respond is measured from detection to containment, so the way to move it is to shorten what happens inside that window: predefined playbooks that have been rehearsed let responders begin containment the moment an alert fires instead of improvising a plan first. Longer log retention deepens what an investigation can reconstruct but does not make containment start any sooner. More frequent authenticated scanning shortens mean time to detect, a separate metric that ends where this one begins. An expanded postmortem template improves the quality of post-incident review, which happens after containment is already complete.

176. A CISO wants a small set of standardized measurements to track the health of the vulnerability management program over time. Which set best represents appropriate vulnerability management metrics?
     • Mean time to detect, alert triage backlog, and analyst handoffs
     • Mean time to remediate, patch service level, and reopening rate
     • Mean time to contain, phishing click rates, and training uptake
     • Open port counts, remote session peaks, and token renewal rates

     Correct answer: Mean time to remediate, patch service level, and reopening rate

     Mean time to remediate, the share of critical findings patched inside the agreed service-level window, and the count of findings that reopen after being closed are the standard trio for a vulnerability management program, because together they measure how fast it fixes things, how reliably it meets its commitments, and whether its fixes hold. Detection latency, triage volume, and handoff counts describe the monitoring pipeline and stop at the point a finding is raised. Containment time with phishing click and training completion rates mixes incident response with security awareness, neither of which measures remediation. Open port counts, session peaks, and token renewal rates are network and infrastructure hygiene figures.

177. After completing a scan, an analyst compiles findings into a vulnerability report for the asset owners. What is the core purpose of a vulnerability report?
     • To record the weaknesses and severities so the owners can prioritize
     • To validate the controls and processes so the assessors can conclude
     • To notify the supplier and regulators so the authorities can respond
     • To capture the timeline and drivers so the investigators can improve

     Correct answer: To record the weaknesses and severities so the owners can prioritize

     A vulnerability report tells asset owners which weaknesses were found, how severe each one is, which assets carry them, and what remediation is recommended, so that limited engineering time goes to the exposures that matter most. It is a prioritization instrument and never a clean bill of health, since no assessment can prove that nothing remains. Validating that controls and processes hold up for an assessor is the compliance report, aimed at a governance audience. Notifying a supplier and regulators is breach notification, a legal obligation triggered by a confirmed incident rather than by a routine scan. Capturing the timeline and the drivers behind an event is the post-incident report, which analyzes something that already happened.

178. A critical patch is available for a manufacturing control server, but applying it would force a production line shutdown that the business will not authorize. In a vulnerability report, how should the analyst categorize this barrier?
     • Compensating control already lowering the production server risk
     • Key risk indicators forecasting the critical production shutdown
     • Service level agreements restricting the production patch window
     • Recorded remediation inhibitor delaying the approved repair work

     Correct answer: Recorded remediation inhibitor delaying the approved repair work

     The barrier is an inhibitor to remediation, the category covering constraints that block or delay a fix, and the specific inhibitor here is business process interruption, since applying the patch would stop the production line. The recognized set also includes memoranda of understanding, service-level agreements, organizational governance, degrading functionality, legacy systems, and proprietary systems. It is not a compensating control, because no alternative safeguard has been put in place yet; the flaw is simply still open and nothing is lowering the exposure. A key risk indicator is a forward-looking forecast of exposure, not a named obstacle already blocking work. A service-level agreement restricts when the fix may be installed and sets the timeline it should meet, so it is one of the things this obstacle causes the team to miss rather than the obstacle itself.

179. Which of the following is the best example of a key performance indicator (KPI) for a vulnerability management program, as opposed to a key risk indicator?
     • Projected likelihood that an unpatched server is exploited shortly
     • Estimated damage should a primary customer database be compromised
     • Percentage of critical findings remediated inside the agreed limit
     • Percentage of staff finishing the annual awareness training course

     Correct answer: Percentage of critical findings remediated inside the agreed limit

     A key performance indicator measures how well a program is doing against a target it owns, and the share of high and critical findings remediated inside the agreed service-level window does exactly that for vulnerability management. A projected chance of exploitation is a key risk indicator: it forecasts exposure rather than grading past work. An estimated loss figure is likewise a risk indicator, expressing potential impact in money. Training completion is a genuine performance indicator, but it grades the security awareness program rather than the vulnerability management program the question asks about, so it measures the wrong team's work.

180. An analyst must brief both the board of directors and the system engineering team about the same newly discovered critical vulnerability. Which approach reflects sound stakeholder communication?
     • Tailor the briefing for each audience, matching specifics to the decisions
     • Send the identical scan export to each audience, ensuring full consistency
     • Postpone the briefing for each audience, holding it until remediation ends
     • Route the findings through tickets for each audience, skipping live briefs

     Correct answer: Tailor the briefing for each audience, matching specifics to the decisions

     Sound stakeholder communication matches the message to what the audience must decide: directors need business impact, risk exposure, and the decisions being asked of them, while engineers need the technical detail and the concrete remediation steps. Sending both groups the identical scanner export looks consistent but leaves the board unable to act on data it cannot interpret. Delaying the briefing until remediation finishes denies leadership the chance to make a risk decision while the risk is live. Routing everything through tickets without a live briefing is a reasonable workflow for engineering intake but gives the board no forum for the decision it owns.

181. A vulnerability management policy states that critical findings must be remediated within 7 days and high findings within 30 days. What is this type of agreement called in a cybersecurity context?
     • A memorandum of understanding agreement between signing partners
     • A nondisclosure agreement covering the shared incident materials
     • A business associate agreement covering processed health records
     • A service level agreement carrying defined remediation deadlines

     Correct answer: A service level agreement carrying defined remediation deadlines

     Committing to fix critical findings within seven days and high findings within thirty is a service-level agreement: it states measurable performance targets with deadlines attached and holds the team accountable to them, which is what makes a metric such as percentage patched within window computable at all. A memorandum of understanding records broad intent to cooperate between parties and deliberately carries no enforceable service target. A nondisclosure agreement restricts how shared information may be disclosed and sets no repair timeline. A business associate agreement obligates a vendor handling protected health data to safeguard it, which is a confidentiality and privacy duty rather than a remediation clock.

182. A monthly vulnerability report shows that the same critical finding on a single host has been reported, marked remediated, and then reappeared in each of the last three scans. Which reporting element most accurately captures this pattern, and what does it signal?
     • A compensating control, showing the residual risk stays covered
     • A re-opened finding, showing the applied repair keeps reverting
     • A missed detection, showing the scanner overlooked one endpoint
     • A zero-day exposure, showing the vendor patch stays unavailable

     Correct answer: A re-opened finding, showing the applied repair keeps reverting

     A finding that is reported, closed, and then detected again on the same host across consecutive scans is a recurring or reopened vulnerability, and the pattern says the remediation is not sticking: configuration drift, a redeployed golden image, or a reverted change keeps reintroducing it. Tracking the reopen rate is a useful program metric precisely because a rising count points at a broken remediation process rather than at new discovery. It is not a false negative, since the scanner is finding the flaw every time. It is not a zero-day, since a fix plainly exists and has been applied more than once. And no alternative safeguard has been introduced, so nothing is being compensated for.