CompTIA CySA+ (CS0-003) Practice Questions with Explanations

Correct answer: A

Eradication is the phase where vulnerabilities and threats are removed from the system to eliminate the root cause of the incident. By isolating the vulnerability and actively removing it, the analyst is performing eradication activities.

Why the other options are wrong:

• B. Recovery involves restoring systems to normal operations after the threat is removed.
• C. Containment focuses on limiting the scope and impact of the incident, not removing the vulnerability.
• D. Preparation is the pre-incident phase focused on readiness and tools, not remediation.

Correct answer: B

The command launches an interactive shell (sh -i) and redirects both its standard output and standard input through a network device file pointing at a remote host and port (/dev/udp/10.1.1.1/4821). That pattern makes the victim machine initiate an outbound connection back to the attacker's listener and hand it a shell, which is the textbook definition of a reverse shell.

Why the other options are wrong:

• A. Remote code execution is the delivery mechanism that would run this payload, but the payload itself is specifically establishing an outbound shell session.
• C. Cross-site scripting involves injecting script into web pages rendered by other users, not shell redirection to a UDP socket.
• D. SQL injection manipulates database query syntax; no SQL statements or database interaction appear here.

Correct answer: B

Securing the scene is the critical first step in any investigation because it preserves evidence, prevents tampering, prevents further damage, and ensures the integrity of the investigation. Without securing the scene, evidence can be lost or contaminated, which undermines all subsequent investigation steps.

Why the other options are wrong:

• A. Notifying law enforcement may come later depending on the incident severity and organizational policy
• C. Seizing evidence happens after the scene is secured to ensure proper chain of custody
• D. Interviewing witnesses occurs after the scene is secured to preserve evidence integrity

Correct answer: D

A 'single pane of glass' refers to a unified interface where security tools and data are consolidated, eliminating the need to switch between multiple systems. By integrating security controls into the SIEM, analysts can view and manage all security information from one location, which directly reduces MTTR by improving efficiency and visibility.

Why the other options are wrong:

• A. Data enrichment adds context to data but doesn't create a unified interface
• B. Security control plane refers to centralized management of controls, not interface consolidation
• C. Threat feed combination involves aggregating threat intelligence sources, not tool integration

Correct answer: A

Risk avoidance involves refusing or discontinuing an activity to eliminate the risk entirely. By rejecting the software request due to excessive risk, the CISO chose not to accept the risk at all, which is the definition of risk avoidance.

Why the other options are wrong:

• B. Transfer would involve shifting risk to a third party through insurance or outsourcing.
• C. Accept would mean acknowledging and tolerating the risk despite its high score.
• D. Mitigate would involve implementing controls to reduce the risk to acceptable levels.

Correct answer: A

Before any analysis or logging access occurs, the first action must be to preserve the evidence in its current state. Cloning the virtual server creates a forensic image that maintains chain of custody and prevents alteration of the original system. Live analysis (option B) risks modifying volatile data and the system state. Restoring from backup (option C) would overwrite potential evidence. Shutting down immediately (option D) without preservation loses volatile evidence and contradicts proper forensic procedure when the system is already isolated.

Why the other options are wrong:

• B. Live analysis on the active system risks contaminating evidence and modifying the environment.
• C. Restoring from backup destroys the current state and any evidence of what actually occurred.
• D. Shutting down without first capturing an image loses all volatile memory evidence and runtime state.

Correct answer: A

The described threat is remotely exploitable, needs no privileges and no user interaction, and impacts confidentiality and integrity heavily while leaving availability untouched. Option A maps exactly to that profile: AV:N (network attack vector, consistent with active remote exploitation), AC:L (low complexity, as seen with a zero-day being exploited at scale), PR:N (no privilege escalation required), UI:N (no user interaction), S:U (unchanged scope), C:H and I:H (significant confidentiality and integrity loss), and A:N (no availability impact). No other vector combines all of these values.

Why the other options are wrong:

• B. It requires high privileges (PR:H) and user interaction (UI:R), and it lists an availability impact (A:L), contradicting the scenario.
• C. It requires user interaction (UI:R), understates confidentiality loss (C:L), and adds a high availability impact the scenario says does not exist.
• D. It restricts the attack to local access (AV:L), requires privileges and user interaction, and shows high availability impact with only low integrity impact.

Correct answer: A

Establishing goals and objectives is the foundational first step in disaster recovery planning because all subsequent decisions about site selection, applications to prioritize, and recovery time objectives (RTO) must align with organizational business requirements and priorities. Without clear goals, the plan will lack direction and may not address the organization's actual needs. This step defines the scope and parameters for all other planning activities.

Why the other options are wrong:

• B. Site selection depends on understanding goals and recovery requirements first.
• C. Demonstrating adherence to standards comes after the plan is developed.
• D. Identifying applications requires understanding business priorities, which comes from goals.

Correct answer: D

When preserving sensitive information before isolating a server, volatile data that exists only in memory or active system state must be captured first. The routing table represents volatile network configuration data that will be lost when the server is powered down or isolated. This follows the order of volatility principle in digital forensics, where the most ephemeral data must be collected before less volatile data like hard disks. Once the server is isolated, this routing information may be impossible to recover.

Why the other options are wrong:

• A. Hard disk data is persistent and can be collected at any time, even after isolation.
• B. Boot partition data is persistent and not at risk of loss during isolation.
• C. Malicious files are persistent on disk and not volatile.
• E. Static IP address configuration is persistent and not at risk during isolation.

Correct answer: C

When investigating a DDoS attack causing internet outage, DNS logs should be reviewed first to identify if the attack involved DNS amplification, DNS flooding, or DNS hijacking. DNS logs will show the attack pattern and help determine the attack vector. While CDN, vulnerability scanner, and web server logs may provide supporting information, DNS logs are most relevant for understanding how the external connectivity was disrupted.

Why the other options are wrong:

• A. CDN logs would show content delivery issues but not the root cause of the DDoS attack itself.
• B. Vulnerability scanner logs are irrelevant to a DDoS attack investigation.
• D. Web server logs might show traffic patterns but DNS logs are more fundamental to understanding connectivity loss.

Correct answer: A

Reducing privileged and administrator accounts is a foundational zero trust principle that addresses a primary attack vector. Compromised privileged accounts are among the most damaging to organizations, making their reduction a top priority in reducing attack surface and aligning with common attack frameworks like MITRE ATT&CK.

Why the other options are wrong:

• B. Network-based IDS is detection-focused, not an attack surface reduction strategy.
• C. Incident response is reactive, not proactive attack surface reduction.
• D. SSO improves usability but doesn't directly reduce attack surface compared to privilege reduction.

Correct answer: A

A Cloud Access Security Broker (CASB) with policy enforcement provides visibility into shadow IT cloud applications and enforces organizational security policies, data protection rules, and compliance controls. CASBs monitor and block unauthorized cloud use while allowing sanctioned applications. MFA, API gateways, and SSO improve security but don't specifically eliminate shadow IT or reduce the risk of unsanctioned cloud applications.

Why the other options are wrong:

• B. MFA secures authentication but doesn't prevent unauthorized cloud application use
• C. API gateways manage API access but don't address shadow IT cloud application discovery and control
• D. SSO improves authentication but doesn't prevent employees from using unsanctioned cloud services

Correct answer: B

Static analysis is the best initial technique for analyzing a malicious binary file because it examines the code without executing it, making it safe and effective for initial assessment. Static analysis can identify malicious signatures, suspicious code patterns, and potential functionality without risking system compromise from execution.

Why the other options are wrong:

• A. Code analysis is too general; static analysis is the specific malware analysis technique.
• C. Reverse engineering is more complex and typically done after initial analysis reveals it's necessary.
• D. Fuzzing is used to find vulnerabilities by providing invalid input, not for analyzing existing malware.

Correct answer: A

Beaconing is when a compromised device maintains periodic communication with an external command-and-control server. The analyst observed an internal device consistently sending traffic to a known-malicious IP (establishing a C2 channel), which is the defining characteristic of beaconing behavior.

Why the other options are wrong:

• B. Cross-site scripting is a web application vulnerability, not network-level device communication
• C. Buffer overflow is a memory exploitation technique, not related to HTTPS traffic patterns to external IPs
• D. PHP traversal is a directory traversal vulnerability in web applications, not relevant to beaconing patterns

Correct answer: A

MITRE ATT&CK is a comprehensive framework specifically designed to catalog and compare Tactics, Techniques, and Procedures (TTPs) used by known adversaries. It enables security analysts to identify patterns and differences between threat actors.

Why the other options are wrong:

• B. Cyber Kill Chain describes attack phases but is not optimized for comparing TTPs between different adversaries.
• C. OWASP focuses on web application security, not adversary TTP analysis.
• D. STIX/TAXII are standards for sharing threat intelligence but not primarily designed for TTP comparison.

Correct answer: D

Before taking any technical action that could impact an employee, HR and legal counsel must be consulted to ensure compliance with employment law, contractual obligations, and organizational policies. Premature technical actions could expose the organization to legal liability and complicate investigations.

Why the other options are wrong:

• A. Isolating the PC without legal/HR guidance could violate employment rights and legal requirements.
• B. Reimaging without proper authorization could constitute inappropriate evidence handling and legal violations.
• C. Remote wiping devices without legal consultation could destroy evidence and violate employment laws.

Correct answer: B

Employee training and awareness is the best control against sensitive information disclosure via file sharing services because it addresses the human behavior component -educating users about data classification, secure file sharing practices, and the risks of unauthorized disclosure. Technical controls alone cannot prevent users who understand the risks from making informed security decisions.

Why the other options are wrong:

• A. Step-up authentication for administrators doesn't address employee use of file sharing services for sensitive data.
• C. Password complexity doesn't prevent intentional or accidental sensitive data uploads to file sharing services.
• D. Mobile device management focuses on device security but doesn't prevent file sharing service misuse from any device.

Correct answer: A

Mean Time to Detect (MTTD) is the best metric to focus on after investing in SIEM, SOAR, and ticketing systems because these tools are specifically designed to identify threats faster and more accurately. MTTD measures the organization's capability to discover security incidents, which directly reflects the value of the detection and orchestration infrastructure. Alert volume and exploit counts are less meaningful, and intrusion attempt quantity does not measure the organization's actual detection capabilities.

Why the other options are wrong:

• B. Number of exploits by tactic measures threat landscape, not detection capability.
• C. Alert volume is a measure of noise, not effectiveness of new tools.
• D. Quantity of intrusion attempts is outside the organization's control and doesn't measure tool effectiveness.

Correct answer: A

Credentialed network scanning provides the most accurate vulnerability assessment results while minimizing excessive access to sensitive data. It uses legitimate authentication credentials to scan systems, allowing deep inspection of configurations and patches without requiring broad privileged access to sensitive information. This balances accuracy with security concerns.

Why the other options are wrong:

• B. Passive scanning provides lower accuracy and may miss many vulnerabilities, not addressing the accuracy requirement.
• C. Agent-based scanning requires installation on all systems and still needs significant system-level access.
• D. Dynamic scanning typically requires execution privileges and can generate more noise/impact on systems.

Correct answer: B

Weaponization is the factor that causes CVSS score escalation when a previously disclosed vulnerability gains a widely available exploit being actively used for attacks like ransomware delivery. While CVSS is the scoring system itself, weaponization specifically refers to the availability and active use of exploits, which is a critical factor in threat intelligence that justifies score increases.

Why the other options are wrong:

• A. Scope in CVSS is a fixed metric that doesn't change after initial scoring based on exploit availability.
• C. CVSS is the system used, not the reason for escalation; the reason is the increased threat from active exploitation.
• D. Asset value may influence prioritization but is not a CVSS metric or standard reason for score escalation.

Correct answer: C

Lessons learned are included in after-action reports specifically to identify areas for improvement in incident response procedures, tools, and processes. This allows the organization to strengthen its capabilities for future incidents. Regulatory compliance (option A) may require incident reporting but not specifically lessons learned sections. Holding departments accountable (option B) is not the primary purpose of lessons learned. Highlighting notable practices (option D) is secondary to the primary goal of improvement.

Why the other options are wrong:

• A. Regulatory reporting requirements don't specifically mandate lessons learned sections.
• B. Lessons learned focus on process improvement, not departmental blame or accountability.
• D. While notable practices may be documented, the primary purpose is identifying gaps and improvements.

Correct answer: D

The actor has already gained access through social engineering (Delivery phase) and is now maintaining that access to continue the attack. This is the Exploitation stage, where the attacker has successfully compromised the system and is working to maintain persistence and control. The actor's concern about losing access indicates they are actively exploiting the compromised environment.

Why the other options are wrong:

• A. Weaponization occurs before delivery when the attacker prepares malicious tools.
• B. Reconnaissance is the initial information gathering phase, not after gaining access.
• C. Delivery is the phase where the attack vector is sent, which has already occurred.

Correct answer: A

Determining the sophistication level of the audience is the best first step in preparing any technical report because it directly influences the depth of technical detail, terminology used, and overall presentation approach. Understanding the audience ensures the report will be appropriately pitched and effectively communicate lessons learned regardless of whether readers are executives or technical staff.

Why the other options are wrong:

• B. Including references and sources is important but comes after understanding audience needs and content requirements.
• C. A table of contents is helpful but is secondary to understanding what level of detail and terminology the audience requires.
• D. Color scheme decisions are cosmetic and come last in report preparation, not affecting the fundamental approach to content.

Correct answer: A

Suspicious file analysis with automatic categorization and organization is an ideal candidate for automation because it involves repeatable, deterministic rules applied to large volumes of data without requiring human judgment for each decision. The process of identifying suspicious graphics, categorizing them by type, and moving them to appropriate folders can be fully automated through scripting. The other options all require significant human judgment, investigation, or follow-up that cannot be fully automated without creating false positives or missing context.

Why the other options are wrong:

• B. Firewall IoC blocking requires human judgment on false positives and may cause business impact.
• C. User support calls require direct human interaction and contextual understanding.
• D. Email analysis with phishing metrics requires human judgment to validate and adjust thresholds.

Correct answer: C

A Disaster Recovery Plan (DRP) specifically focuses on restoring critical systems and services after an incident or disaster, ensuring mission-critical operations resume. While business continuity planning (BCP) addresses broader organizational continuity, DRP is the technical implementation that directly ensures service availability post-incident. Vulnerability and asset management plans prevent incidents but don't ensure recovery.

Why the other options are wrong:

• A. BCP addresses organizational continuity but is broader than ensuring technical service availability
• B. Vulnerability management prevents incidents but doesn't restore services after they fail
• D. Asset management tracks resources but doesn't restore availability during incidents

Correct answer: B

An external IP address running network and vulnerability scans against external-facing assets is conducting reconnaissance. This is the second phase of the attack framework where the attacker gathers information about the target systems, their vulnerabilities, and network topology to prepare for future attacks.

Why the other options are wrong:

• A. Exploitation involves actually compromising systems, not just scanning.
• C. Command and control is established after a successful compromise.
• D. Actions on objectives occur after exploitation when the attacker achieves their goals.

Correct answer: A

A single pane of glass provides a unified interface to view and manage multiple data sources and threat feeds in one consolidated location. This directly addresses the need to consolidate several threat intelligence feeds and portals while maximizing visibility and results.

Why the other options are wrong:

• B. Single sign-on manages user authentication across systems but doesn't consolidate data sources.
• C. Data enrichment adds context to threat data but doesn't consolidate multiple feeds into one interface.
• D. Deduplication removes duplicate data but doesn't provide the consolidated view needed for the stated goal.

Correct answer: A

The incident response policy or plan documents the communication framework, including escalation procedures, contact lists, and timing requirements for notification. This ensures consistent, documented communication during incidents and clarifies roles and responsibilities for the CSIRT lead.

Why the other options are wrong:

• B. While management may be consulted, the policy provides the authoritative guidance, not arbitrary management decisions
• C. The lead must follow established policies and procedures, not make unilateral decisions about communication
• D. While SMEs communicate within their areas, the overarching decision-making and timing come from the incident response plan

Correct answer: D

Under PCI DSS compliance requirements, organizations experiencing a breach of cardholder data must report the incident to the card issuer or acquiring bank, as they are the entity responsible for the payment card accounts affected. The PCI Security Standards Council is not a breach notification recipient, and while law enforcement may be involved in some cases, PCI DSS specifically mandates notification to the card issuer as the primary compliance requirement.

Why the other options are wrong:

• A. The PCI Security Standards Council is not a breach notification recipient.
• B. Local law enforcement is not required by PCI DSS for breach notification.
• C. Federal law enforcement is not required by PCI DSS for breach notification.

Correct answer: C

Using application security scanning as part of the CI/CD pipeline ensures vulnerabilities are caught early and continuously throughout the development process. This prevents the same vulnerabilities from repeatedly appearing in production by integrating security testing into the development workflow itself, making it a systematic and automated approach.

Why the other options are wrong:

• A. Red team exercises are post-deployment testing and don't prevent vulnerabilities during development.
• B. Checking coding libraries helps but doesn't directly address application-specific vulnerabilities.
• D. Input validation is a specific coding practice but doesn't systematically catch all recurring vulnerabilities across the pipeline.

Correct answer: B

An on-path attacker with internal access can intercept HTTPS requests and force downgrade to HTTP (port 80), which explains why users intermittently see both HTTP and HTTPS access. This is consistent with compromised user accounts and represents an active man-in-the-middle attack. SSL certificate issues would cause complete unavailability, load balancing wouldn't downgrade protocols, and BGP changes don't affect individual user protocol selection.

Why the other options are wrong:

• A. SSL certificate issues cause consistent HTTPS failures, not intermittent switching between protocols
• C. Web servers under load use internal queuing, not protocol downgrade to HTTP
• D. BGP operates at network routing layer and doesn't control application-layer protocol selection

Correct answer: A

The lessons-learned phase focuses on continuous improvement by identifying what worked, what didn't, and how processes and procedures can be enhanced. This forward- looking perspective drives organizational learning and strengthens future incident response capabilities.

Why the other options are wrong:

• B. Identifying individuals for blame is counterproductive to blameless post-incident reviews and discourages honest analysis.
• C. Presenting legal evidence to law enforcement is part of evidence handling, not lessons-learned analysis.
• D. While financial impact matters, determining ROI of controls is secondary to process improvement in lessons-learned.

Correct answer: C

The function using 'dig' with reverse DNS lookups and ASN/CYMRU queries performs ASN (Autonomous System Number) lookups which provide routing origin information. This identifies which autonomous systems traffic is routing through, making it the most accurate method for identifying anomalies in network routing patterns by revealing unexpected or suspicious routing origins.

Why the other options are wrong:

• A. GeoIP lookup provides geographic location data, not routing-specific information needed for routing anomalies.
• B. Ping latency measurements show response times but don't reveal routing path or origin information.
• D. Traceroute shows the path taken but doesn't identify the autonomous system or routing origin information needed for routing anomaly analysis.

Correct answer: A

Since exploits occur 45 days after patch release, establishing a Mean Time To Remediate (MTTR) of 30 days ensures patches are deployed before widespread exploitation occurs. This directly addresses the threat window. MTTD of 45 days would match the exploit timeline (too slow), MTTR of 15 days only measures response time without guaranteeing completion, and third-party testing adds delay to patch deployment.

Why the other options are wrong:

• B. MTTD of 45 days matches the exploitation timeline, providing no protection advantage
• C. MTTR of 15 days measures response initiation but doesn't guarantee completion within the threat window
• D. Third-party testing adds time before patches are deployed, increasing vulnerability exposure

Correct answer: D

Data Loss Prevention (DLP) is specifically designed to monitor, detect, and prevent unauthorized transmission of sensitive information including PII outside organizational boundaries. DLP tools scan data in motion and at rest to enforce policies against exfiltration. PAM manages privileged access, IDS detects intrusions, and PKI manages encryption-none are designed to specifically prevent PII exposure.

Why the other options are wrong:

• A. PAM controls privileged account access but doesn't prevent data exfiltration
• B. IDS detects network intrusions but doesn't prevent sensitive data disclosure
• C. PKI manages certificates and encryption but doesn't monitor for data exposure

Correct answer: A

Uploading binaries to an air-gapped sandbox ensures analysis without disclosing information to attackers because the isolated environment has no internet connectivity, preventing the malware from communicating with command-and-control servers or allowing attackers to detect the analysis. This maintains operational security by keeping the investigation hidden from adversaries.

Why the other options are wrong:

• B. Sending binaries to antivirus vendors immediately discloses the malware samples to third parties and potentially to attackers.
• C. Executing on an internet-connected environment allows malware to communicate with attackers, revealing the analysis.
• D. Querying VirusTotal uploads the file hash and sample to a public service, immediately disclosing the investigation to attackers.

Correct answer: C

Validation is the next step after applying a patch because the organization must confirm that the patch was successfully applied, that the vulnerability has been remediated, and that no adverse side effects occurred. Testing typically occurs before implementation in a controlled environment, while validation occurs after implementation on the production system to verify effectiveness. Rollback is only performed if validation reveals problems.

Why the other options are wrong:

• A. Testing should occur before implementation in a test environment.
• B. Implementation (patch application) has already been done in the scenario.
• D. Rollback is a contingency action only if validation reveals failure.

Correct answer: B

Ensure that the case details do not reflect any user- identifiable information Password protect the evidence and restrict access to personnel related to the investigation To ensure compliance with HR and privacy policies when conducting an investigation that could result in employment action, the organization must minimize personally identifiable information (PII) exposure in documentation, restrict access to evidence only to those with a legitimate need to know, and implement security controls like password protection. This approach protects the employee's privacy rights while maintaining the integrity of the investigation and reduces organizational legal liability under privacy and employment laws.

Why the other options are wrong:

• A. Creating a timeline with identifying information violates privacy principles; identifiers should be minimized.
• C. Using code names does not comply with privacy policies; access controls are required, not obfuscation.
• D. Notifying the manager after confirmation is process-related but does not address privacy protection of evidence.

Correct answer: A

A Service Level Agreement (SLA) defines specific contractual commitments regarding service delivery, including response times, resolution times, and reporting obligations. The SOC manager should consult the SLA to verify the contractual timeline for remediation follow-up after vulnerability reporting.

Why the other options are wrong:

• B. An MOU (Memorandum of Understanding) is a less formal agreement and doesn't typically contain specific service timing requirements
• C. An NDA (Non-Disclosure Agreement) covers confidentiality obligations, not service delivery commitments
• D. Limitation of liability clauses restrict legal responsibility but don't establish service level commitments

Correct answer: C

SOAR (Security Orchestration, Automation and Response) is specifically designed to minimize human engagement by automating repetitive security tasks and orchestrating responses across multiple tools. This directly supports process improvement in security operations by reducing manual work, improving response times, and enabling analysts to focus on higher-level tasks.

Why the other options are wrong:

• A. OSSTMM is a testing methodology framework, not an automation platform.
• B. SIEM is a log aggregation and analysis tool that still requires human interpretation and decision-making.
• D. OWASP is a web application security framework, not related to security operations automation.

Correct answer: A

The Command and Control (C2) phase is when the attacker establishes a communication channel with the compromised target to issue commands and maintain persistent access. This occurs after successful exploitation and is fundamental to the attacker maintaining control over the compromised system.

Why the other options are wrong:

• B. Actions on objectives occurs after C2 is established and involves the attacker achieving their goals
• C. Exploitation is when vulnerabilities are triggered, occurring before C2 communication is established
• D. Delivery is when the exploit payload is delivered to the target, occurring before exploitation

Correct answer: A

The core issue is that the company lacks access to update a vendor appliance due to vendor control and proprietary restrictions. This is a proprietary system inhibitor-the company cannot modify or patch the system because they don't have control over it. The system is vendor-dependent and the company cannot independently remediate the vulnerabilities.

Why the other options are wrong:

• B. Legacy systems are outdated but can typically be upgraded or replaced; the issue here is lack of vendor access.
• C. Unsupported operating systems would be out of vendor support, but the problem is the proprietary appliance itself.
• D. The problem is not maintenance windows but rather inability to access the vendor appliance to update it.

Correct answer: D

A signed user agreement creates legal accountability and documented acknowledgment of the policy. This establishes that the employee cannot claim ignorance and ensures they are legally bound to comply with company policies. Email alone (option A) lacks confirmation of receipt or comprehension. Verbal confirmation (option B) is not documented and difficult to verify. A test (option C) verifies understanding but doesn't create the same level of accountability as a signed acknowledgment. A signature on a user agreement is the standard practice across organizations for establishing accountability.

Why the other options are wrong:

• A. Email delivery cannot verify that the employee actually read or understood the policy.
• B. Verbal confirmation is not documented and provides no legal record of acknowledgment.
• C. A test measures knowledge but doesn't create binding accountability or legal acknowledgment.

Correct answer: A

An information sharing organization (such as ISACs or ISAOs specific to critical infrastructure or manufacturing) is the best source for threat intelligence about campaigns targeting critical supply chain entities. These organizations specialize in sharing threats relevant to specific sectors and critical infrastructure. Blogs/forums (option B) provide general information but lack sector-specific context. The incident response team (option C) investigates but isn't a primary intelligence source for new campaigns. The dark web (option D) is not a reliable or appropriate source for supply chain threat intelligence.

Why the other options are wrong:

• B. Blogs and forums lack verified, sector-specific threat intelligence relevant to critical manufacturing.
• C. The incident response team responds to incidents but isn't a source for external threat campaign research.
• D. The dark web is unreliable, unverified, and not the appropriate channel for critical infrastructure threat intelligence.

Correct answer: B

Cloud-specific misconfigurations such as overly permissive IAM policies, exposed storage buckets, insecure API endpoints, and misconfigured security groups may not be detected by traditional on-premises vulnerability scanners designed for network and system vulnerabilities. These scanners typically focus on CVEs and application-level issues, not the configuration vulnerabilities endemic to IaaS platforms like AWS, Azure, or GCP. The organization must augment its scanning program with cloud-native security tools.

Why the other options are wrong:

• A. Migrating existing scanners to cloud is not necessary; specialized cloud scanners can supplement them.
• C. Existing vulnerability scanners can scan systems in IaaS, though they have limitations.
• D. Scans can be performed from on-premises or cloud; location is not the primary issue.

Correct answer: A

Regular outgoing HTTPS connections to a public IP address around the clock, to a destination the server should not contact, is classic command-and-control (C2) beaconing behavior. The consistency of the pattern and the fact it occurs during both work and after- hours indicates automated malicious communication rather than legitimate business activity. Data exfiltration (option B) may use HTTPS but wouldn't necessarily show regular patterns. Anomalous ports (option C) is vague and less specific. IP scanning (option D) and rogue devices (option E) don't match the described behavior pattern.

Why the other options are wrong:

• B. Data exfiltration would typically involve larger data transfers rather than regular small connection patterns.
• C. This describes the symptom but not the most likely cause; HTTPS uses expected ports.
• D. Host scanning would show different network behavior patterns, not regular connections to a single IP.
• E. A rogue device would not explain outgoing connections originating from the specific server.

Correct answer: B

Agent-based scanning is the best solution for geographically diverse workforces with dynamic IPs because agents are installed on individual systems and report back to a central server, eliminating the need for the scanner to maintain network connectivity to target systems. This reduces network traffic compared to external scanning which must traverse networks, and agents can work regardless of IP changes or geographic location.

Why the other options are wrong:

• A. External scanning requires network-level access and generates significant traffic across diverse geographic locations.
• C. Non-credentialed scanning still requires network connectivity and generates traffic during scanning.
• D. Credentialed scanning still requires network access and traffic similar to non- credentialed methods.

Correct answer: C

FTP data transfers occur on a separate data channel (port 20 by default) from the FTP control channel (port 21). The ftp filter shows control commands but not the actual file contents. Using 'ftp-data' to show data stream packets and following the TCP streams allows the analyst to reconstruct and view the complete downloaded files.

Why the other options are wrong:

• A. ftp.active.port is an FTP filter for active mode port negotiation, not for viewing transferred data
• B. tcp.port==20 would show the data channel packets but not reconstruct the file contents without following the streams
• D. The File menu export option exports objects from HTTP/HTTPS, not FTP data streams

Correct answer: C

A risk assessment provides comprehensive analysis of threats, vulnerabilities, likelihood, and business impact organized at a strategic level suitable for executive consumption. It synthesizes threat information with organizational context to support decision-making, whereas the other options provide lower-level operational data.

Why the other options are wrong:

• A. Firewall logs contain tactical network data but lack the risk prioritization and business context needed for executives
• B. Indicators of compromise are specific forensic artifacts, not strategic threat analysis suitable for executive briefings
• D. Access control lists are configuration details unrelated to threat analysis

Correct answer: B

After an incident concludes, the best action for future improvement is to conduct a post- incident review with all relevant teams to discuss what happened, what went well, what didn't, and what can be improved. This lessons-learned session is critical for improving incident response capabilities and preventing recurrence.

Why the other options are wrong:

• A. A call tree is used during incident response, not after to improve future response.
• C. An executive summary documents the incident but doesn't directly improve future response.
• D. Regulatory compliance review is important but secondary to learning from the incident internally.