Practice Exams:

View All

CompTIA CySA+ CS0-003 Tools And Techniques For Determining Malicious Activity Practice Test

Objective 1.3 • 40 original questions

This CompTIA CySA+ CS0-003 practice test focuses on objective 1.3: tools and techniques for determining malicious activity. All questions are original ExamSnap scenarios aligned to the official CS0-003 objective set; they are not copied from live CompTIA exam content. Review every option explanation to understand why a choice fits or does not fit the scenario. For broader exam preparation, review the CompTIA CySA+ CS0-003 Exam Dumps page.

Instructions: Select the best answer unless the question explicitly says Select TWO or Select THREE. Review the explanation and option review after answering.

Question 1

In a multi-site enterprise, a security administrator must inspect actual packets exchanged during a suspicious connection. Which approach is MOST appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

Packet capture with Wireshark or tcpdump
PowerShell or shell scripting
DNS/IP reputation lookup
Hash analysis
User behavior analytics

Correct answer: A

Why: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. It directly fits this scenario because the requirement is to inspect actual packets exchanged during a suspicious connection.

Option review:

A: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. It directly fits this scenario because the requirement is to inspect actual packets exchanged during a suspicious connection.

B: PowerShell and shell scripts automate administrative and investigative tasks in their native operating environments. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect actual packets exchanged during a suspicious connection.

C: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect actual packets exchanged during a suspicious connection.

D: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect actual packets exchanged during a suspicious connection.

E: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect actual packets exchanged during a suspicious connection.

Learning point: Use Packet capture with Wireshark or tcpdump when the key requirement is to inspect actual packets exchanged during a suspicious connection.

Question 2

A review at Consolidated Messenger finds a gap: the team cannot reliably correlate authentication, endpoint, firewall, and application events in one investigation. Which option best closes that gap? Assume the activity is authorized and must follow normal enterprise change control.

SIEM correlation
Suspicious-command interpretation
PowerShell or shell scripting
Regular expressions
Python automation

Correct answer: A

Why: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. It directly fits this scenario because the requirement is to correlate authentication, endpoint, firewall, and application events in one investigation.

Option review:

A: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. It directly fits this scenario because the requirement is to correlate authentication, endpoint, firewall, and application events in one investigation.

B: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate authentication, endpoint, firewall, and application events in one investigation.

C: PowerShell and shell scripts automate administrative and investigative tasks in their native operating environments. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate authentication, endpoint, firewall, and application events in one investigation.

D: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate authentication, endpoint, firewall, and application events in one investigation.

E: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate authentication, endpoint, firewall, and application events in one investigation.

Learning point: Use SIEM correlation when the key requirement is to correlate authentication, endpoint, firewall, and application events in one investigation.

Question 3

a blue-team analyst at Adventure Works is comparing several approaches. The deciding requirement is to automate a repeatable enrichment-and-response playbook across security tools. Which option should be chosen? Assume no additional product-specific features are available beyond the concepts listed.

Email-header analysis
SOAR workflow
Hash analysis
VirusTotal lookup
Packet capture with Wireshark or tcpdump

Correct answer: B

Option review:

A: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate a repeatable enrichment-and-response playbook across security tools.

B: SOAR platforms orchestrate repeatable response steps across tools and can automate enrichment and containment actions. It directly fits this scenario because the requirement is to automate a repeatable enrichment-and-response playbook across security tools.

C: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate a repeatable enrichment-and-response playbook across security tools.

D: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate a repeatable enrichment-and-response playbook across security tools.

E: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate a repeatable enrichment-and-response playbook across security tools.

Learning point: Use SOAR workflow when the key requirement is to automate a repeatable enrichment-and-response playbook across security tools.

Question 4

During a security review, an incident coordinator must address two separate needs: investigate process execution and isolate a compromised endpoint, and identify whether two files are identical and query known-file intelligence. Select TWO. The organization wants a vendor-neutral approach that can be explained during audit review.

Hash analysis
JSON or XML parsing
Python automation
Sandbox detonation
Endpoint detection and response (EDR)

Correct answers: A, E

Why: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. It directly fits this scenario because the requirement is to identify whether two files are identical and query known-file intelligence. EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. It directly fits this scenario because the requirement is to investigate process execution and isolate a compromised endpoint.

Option review:

A: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. It directly fits this scenario because the requirement is to identify whether two files are identical and query known-file intelligence.

B: JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate process execution and isolate a compromised endpoint; identify whether two files are identical and query known-file intelligence.

C: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate process execution and isolate a compromised endpoint; identify whether two files are identical and query known-file intelligence.

D: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate process execution and isolate a compromised endpoint; identify whether two files are identical and query known-file intelligence.

E: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. It directly fits this scenario because the requirement is to investigate process execution and isolate a compromised endpoint.

Learning point: Use Endpoint detection and response (EDR), Hash analysis when the key requirement is to investigate process execution and isolate a compromised endpoint; identify whether two files are identical and query known-file intelligence.

Question 5

A new security procedure at Datum Fabrication must enable analysts to evaluate whether an unfamiliar external IP or domain has a suspicious reputation. Which option is the BEST choice? Base the decision on the primary security requirement, not on implementation convenience.

SPF, DKIM, and DMARC validation
Sandbox detonation
Hash analysis
DNS/IP reputation lookup
Endpoint detection and response (EDR)

Correct answer: D

Option review:

A: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

B: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

C: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

D: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. It directly fits this scenario because the requirement is to evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

E: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

Learning point: Use DNS/IP reputation lookup when the key requirement is to evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

Question 6

The primary objective for Tailspin Toys is to quickly inspect a suspicious binary for embedded human-readable indicators. Which selection best satisfies that objective in an e-commerce platform? The environment follows least privilege and preserves evidence where incident handling is involved.

Strings analysis
VirusTotal lookup
Endpoint detection and response (EDR)
Embedded-link analysis
Command-and-control pattern recognition

Correct answer: A

Why: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. It directly fits this scenario because the requirement is to quickly inspect a suspicious binary for embedded human-readable indicators.

Option review:

A: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. It directly fits this scenario because the requirement is to quickly inspect a suspicious binary for embedded human-readable indicators.

B: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to quickly inspect a suspicious binary for embedded human-readable indicators.

C: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to quickly inspect a suspicious binary for embedded human-readable indicators.

E: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to quickly inspect a suspicious binary for embedded human-readable indicators.

Learning point: Use Strings analysis when the key requirement is to quickly inspect a suspicious binary for embedded human-readable indicators.

Question 7

At Proseware Research, a malware analyst needs to check whether a known hash or URL has prior multi-engine detections. Which option is the BEST fit for a restricted research segment? Use the choice that most directly addresses the stated evidence rather than a broader control.

Python automation
Regular expressions
VirusTotal lookup
Email-header analysis
DNS/IP reputation lookup

Correct answer: C

Why: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. It directly fits this scenario because the requirement is to check whether a known hash or URL has prior multi-engine detections.

Option review:

A: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to check whether a known hash or URL has prior multi-engine detections.

B: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to check whether a known hash or URL has prior multi-engine detections.

C: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. It directly fits this scenario because the requirement is to check whether a known hash or URL has prior multi-engine detections.

D: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to check whether a known hash or URL has prior multi-engine detections.

E: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to check whether a known hash or URL has prior multi-engine detections.

Learning point: Use VirusTotal lookup when the key requirement is to check whether a known hash or URL has prior multi-engine detections.

Question 8

During a security review, a SOC analyst must address two separate needs: observe the runtime behavior of a suspicious file without executing it on a production endpoint, and write a cross-platform script to enrich indicators through an API. Select TWO. The team wants the most defensible analyst action before expanding the investigation.

SPF, DKIM, and DMARC validation
VirusTotal lookup
Python automation
Endpoint detection and response (EDR)
Sandbox detonation

Correct answers: C, E

Why: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. It directly fits this scenario because the requirement is to write a cross-platform script to enrich indicators through an API. A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. It directly fits this scenario because the requirement is to observe the runtime behavior of a suspicious file without executing it on a production endpoint.

Option review:

A: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe the runtime behavior of a suspicious file without executing it on a production endpoint; write a cross-platform script to enrich indicators through an API.

B: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe the runtime behavior of a suspicious file without executing it on a production endpoint; write a cross-platform script to enrich indicators through an API.

C: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. It directly fits this scenario because the requirement is to write a cross-platform script to enrich indicators through an API.

D: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe the runtime behavior of a suspicious file without executing it on a production endpoint; write a cross-platform script to enrich indicators through an API.

E: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. It directly fits this scenario because the requirement is to observe the runtime behavior of a suspicious file without executing it on a production endpoint.

Learning point: Use Sandbox detonation, Python automation when the key requirement is to observe the runtime behavior of a suspicious file without executing it on a production endpoint; write a cross-platform script to enrich indicators through an API.

Question 9

Woodgrove Bank is updating its security operations standard for a high-value payment environment. Which option most directly helps the team recognize traffic behavior consistent with command-and-control check-ins? Select based on the scenario’s decisive constraint, not on which technology is newest.

Command-and-control pattern recognition
Regular expressions
SPF, DKIM, and DMARC validation
Python automation
DNS/IP reputation lookup

Correct answer: A

Option review:

A: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. It directly fits this scenario because the requirement is to recognize traffic behavior consistent with command-and-control check-ins.

B: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recognize traffic behavior consistent with command-and-control check-ins.

C: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recognize traffic behavior consistent with command-and-control check-ins.

D: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recognize traffic behavior consistent with command-and-control check-ins.

E: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recognize traffic behavior consistent with command-and-control check-ins.

Learning point: Use Command-and-control pattern recognition when the key requirement is to recognize traffic behavior consistent with command-and-control check-ins.

Question 10

A ticket at Humongous Insurance asks a risk analyst to determine what an unusual shell or PowerShell command is attempting to do. Which choice addresses the requirement most directly? Assume the activity is authorized and must follow normal enterprise change control.

Python automation
JSON or XML parsing
Hash analysis
Suspicious-command interpretation
Endpoint detection and response (EDR)

Correct answer: D

Why: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. It directly fits this scenario because the requirement is to determine what an unusual shell or PowerShell command is attempting to do.

Option review:

A: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine what an unusual shell or PowerShell command is attempting to do.

B: JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine what an unusual shell or PowerShell command is attempting to do.

C: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine what an unusual shell or PowerShell command is attempting to do.

D: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. It directly fits this scenario because the requirement is to determine what an unusual shell or PowerShell command is attempting to do.

E: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine what an unusual shell or PowerShell command is attempting to do.

Learning point: Use Suspicious-command interpretation when the key requirement is to determine what an unusual shell or PowerShell command is attempting to do.

Question 11

In a hospital network, a SOC analyst must trace a suspicious email and inspect sender-routing metadata. Which approach is MOST appropriate? Assume no additional product-specific features are available beyond the concepts listed.

Email-header analysis
SIEM correlation
VirusTotal lookup
Packet capture with Wireshark or tcpdump
Regular expressions

Correct answer: A

Why: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. It directly fits this scenario because the requirement is to trace a suspicious email and inspect sender-routing metadata.

Option review:

A: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. It directly fits this scenario because the requirement is to trace a suspicious email and inspect sender-routing metadata.

B: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to trace a suspicious email and inspect sender-routing metadata.

C: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to trace a suspicious email and inspect sender-routing metadata.

D: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to trace a suspicious email and inspect sender-routing metadata.

E: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to trace a suspicious email and inspect sender-routing metadata.

Learning point: Use Email-header analysis when the key requirement is to trace a suspicious email and inspect sender-routing metadata.

Question 12

A review at Blue Yonder Airlines finds a gap: the team cannot reliably evaluate whether a message passed domain-level sender authentication controls. Which option best closes that gap? The organization wants a vendor-neutral approach that can be explained during audit review.

Sandbox detonation
User behavior analytics
Embedded-link analysis
Impossible-travel detection
SPF, DKIM, and DMARC validation

Correct answer: E

Why: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. It directly fits this scenario because the requirement is to evaluate whether a message passed domain-level sender authentication controls.

Option review:

A: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether a message passed domain-level sender authentication controls.

B: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether a message passed domain-level sender authentication controls.

C: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether a message passed domain-level sender authentication controls.

D: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether a message passed domain-level sender authentication controls.

E: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. It directly fits this scenario because the requirement is to evaluate whether a message passed domain-level sender authentication controls.

Learning point: Use SPF, DKIM, and DMARC validation when the key requirement is to evaluate whether a message passed domain-level sender authentication controls.

Question 13

At Lucerne Publishing, a detection engineer has two simultaneous requirements: evaluate a suspicious hyperlink embedded in an email, and automate a repeatable enrichment-and-response playbook across security tools. Which TWO options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

SOAR workflow
Embedded-link analysis
Strings analysis
SPF, DKIM, and DMARC validation
Command-and-control pattern recognition

Correct answers: A, B

Option review:

A: SOAR platforms orchestrate repeatable response steps across tools and can automate enrichment and containment actions. It directly fits this scenario because the requirement is to automate a repeatable enrichment-and-response playbook across security tools.

B: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. It directly fits this scenario because the requirement is to evaluate a suspicious hyperlink embedded in an email.

C: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate a suspicious hyperlink embedded in an email; automate a repeatable enrichment-and-response playbook across security tools.

D: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate a suspicious hyperlink embedded in an email; automate a repeatable enrichment-and-response playbook across security tools.

E: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate a suspicious hyperlink embedded in an email; automate a repeatable enrichment-and-response playbook across security tools.

Learning point: Use Embedded-link analysis, SOAR workflow when the key requirement is to evaluate a suspicious hyperlink embedded in an email; automate a repeatable enrichment-and-response playbook across security tools.

Question 14

For an online banking environment, the team must accomplish both of these goals: identify whether two files are identical and query known-file intelligence, and investigate process execution and isolate a compromised endpoint. Which TWO choices together provide the best match? The environment follows least privilege and preserves evidence where incident handling is involved.

Hash analysis
Strings analysis
Endpoint detection and response (EDR)
VirusTotal lookup
SIEM correlation

Correct answers: A, C

Option review:

B: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify whether two files are identical and query known-file intelligence; investigate process execution and isolate a compromised endpoint.

C: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. It directly fits this scenario because the requirement is to investigate process execution and isolate a compromised endpoint.

D: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify whether two files are identical and query known-file intelligence; investigate process execution and isolate a compromised endpoint.

E: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify whether two files are identical and query known-file intelligence; investigate process execution and isolate a compromised endpoint.

Learning point: Use Hash analysis, Endpoint detection and response (EDR) when the key requirement is to identify whether two files are identical and query known-file intelligence; investigate process execution and isolate a compromised endpoint.

Question 15

A new security procedure at City Power Utilities must enable analysts to identify abnormal account behavior relative to a normal user baseline. Which option is the BEST choice? Use the choice that most directly addresses the stated evidence rather than a broader control.

User behavior analytics
Suspicious-command interpretation
Impossible-travel detection
Embedded-link analysis
JSON or XML parsing

Correct answer: A

Why: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. It directly fits this scenario because the requirement is to identify abnormal account behavior relative to a normal user baseline.

Option review:

A: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. It directly fits this scenario because the requirement is to identify abnormal account behavior relative to a normal user baseline.

B: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify abnormal account behavior relative to a normal user baseline.

C: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify abnormal account behavior relative to a normal user baseline.

E: JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify abnormal account behavior relative to a normal user baseline.

Learning point: Use User behavior analytics when the key requirement is to identify abnormal account behavior relative to a normal user baseline.

Question 16

The primary objective for A. Datum Logistics is to detect sign-ins from distant locations with insufficient travel time. Which selection best satisfies that objective in a newly acquired subsidiary? The team wants the most defensible analyst action before expanding the investigation.

Command-and-control pattern recognition
Impossible-travel detection
Embedded-link analysis
SPF, DKIM, and DMARC validation
Endpoint detection and response (EDR)

Correct answer: B

Why: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. It directly fits this scenario because the requirement is to detect sign-ins from distant locations with insufficient travel time.

Option review:

A: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to detect sign-ins from distant locations with insufficient travel time.

B: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. It directly fits this scenario because the requirement is to detect sign-ins from distant locations with insufficient travel time.

C: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to detect sign-ins from distant locations with insufficient travel time.

D: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to detect sign-ins from distant locations with insufficient travel time.

E: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to detect sign-ins from distant locations with insufficient travel time.

Learning point: Use Impossible-travel detection when the key requirement is to detect sign-ins from distant locations with insufficient travel time.

Question 17

At Northwind Traders, a security engineer needs to parse structured security-tool or API output for automation. Which option is the BEST fit for a regional distribution network? Select based on the scenario’s decisive constraint, not on which technology is newest.

JSON or XML parsing
Email-header analysis
SIEM correlation
VirusTotal lookup
DNS/IP reputation lookup

Correct answer: A

Option review:

A: JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. It directly fits this scenario because the requirement is to parse structured security-tool or API output for automation.

B: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to parse structured security-tool or API output for automation.

C: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to parse structured security-tool or API output for automation.

D: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to parse structured security-tool or API output for automation.

E: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to parse structured security-tool or API output for automation.

Learning point: Use JSON or XML parsing when the key requirement is to parse structured security-tool or API output for automation.

Question 18

During an investigation at Alpine Ski House, the immediate requirement is to write a cross-platform script to enrich indicators through an API. What should a cloud security analyst select? Assume the activity is authorized and must follow normal enterprise change control.

VirusTotal lookup
User behavior analytics
Python automation
Impossible-travel detection
SIEM correlation

Correct answer: C

Option review:

A: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to write a cross-platform script to enrich indicators through an API.

B: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to write a cross-platform script to enrich indicators through an API.

D: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to write a cross-platform script to enrich indicators through an API.

E: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to write a cross-platform script to enrich indicators through an API.

Learning point: Use Python automation when the key requirement is to write a cross-platform script to enrich indicators through an API.

Question 19

Coho Winery is updating its security operations standard for a branch-office network. Which option most directly helps the team automate endpoint or server investigation steps with native command-line tooling? Assume no additional product-specific features are available beyond the concepts listed.

Command-and-control pattern recognition
PowerShell or shell scripting
Regular expressions
VirusTotal lookup
User behavior analytics

Correct answer: B

Option review:

A: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate endpoint or server investigation steps with native command-line tooling.

B: PowerShell and shell scripts automate administrative and investigative tasks in their native operating environments. It directly fits this scenario because the requirement is to automate endpoint or server investigation steps with native command-line tooling.

C: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate endpoint or server investigation steps with native command-line tooling.

D: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate endpoint or server investigation steps with native command-line tooling.

E: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate endpoint or server investigation steps with native command-line tooling.

Learning point: Use PowerShell or shell scripting when the key requirement is to automate endpoint or server investigation steps with native command-line tooling.

Question 20

A ticket at Litware Manufacturing asks an incident responder to extract repeated indicator patterns from large text logs. Which choice addresses the requirement most directly? The organization wants a vendor-neutral approach that can be explained during audit review.

Hash analysis
Sandbox detonation
Regular expressions
Suspicious-command interpretation
Packet capture with Wireshark or tcpdump

Correct answer: C

Option review:

A: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to extract repeated indicator patterns from large text logs.

B: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to extract repeated indicator patterns from large text logs.

C: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. It directly fits this scenario because the requirement is to extract repeated indicator patterns from large text logs.

D: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to extract repeated indicator patterns from large text logs.

E: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to extract repeated indicator patterns from large text logs.

Learning point: Use Regular expressions when the key requirement is to extract repeated indicator patterns from large text logs.

Question 21

A focused review of a hybrid cloud workload produced the following situation: an analyst is validating a single decisive control requirement. The analyst’s next decision is limited to how to inspect actual packets exchanged during a suspicious connection. What should be selected?

DNS/IP reputation lookup
Embedded-link analysis
Packet capture with Wireshark or tcpdump
User behavior analytics
Impossible-travel detection

Correct answer: C

Option review:

A: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect actual packets exchanged during a suspicious connection.

B: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect actual packets exchanged during a suspicious connection.

C: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. It directly fits this scenario because the requirement is to inspect actual packets exchanged during a suspicious connection.

D: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect actual packets exchanged during a suspicious connection.

E: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect actual packets exchanged during a suspicious connection.

Learning point: Use Packet capture with Wireshark or tcpdump when the key requirement is to inspect actual packets exchanged during a suspicious connection.

Question 22

During triage in a remote branch, telemetry was preserved before any containment change. The investigation question is not broad hardening; it is specifically how to correlate authentication, endpoint, firewall, and application events in one investigation. Which option is the clearest match?

Email-header analysis
Hash analysis
JSON or XML parsing
Sandbox detonation
SIEM correlation

Correct answer: E

Option review:

A: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate authentication, endpoint, firewall, and application events in one investigation.

B: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate authentication, endpoint, firewall, and application events in one investigation.

C: JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate authentication, endpoint, firewall, and application events in one investigation.

D: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate authentication, endpoint, firewall, and application events in one investigation.

E: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. It directly fits this scenario because the requirement is to correlate authentication, endpoint, firewall, and application events in one investigation.

Learning point: Use SIEM correlation when the key requirement is to correlate authentication, endpoint, firewall, and application events in one investigation.

Question 23

The security lead documents this constraint for an industrial DMZ: the operations team requires a vendor-neutral decision. Success is defined as being able to automate a repeatable enrichment-and-response playbook across security tools. Which answer best satisfies the constraint?

Impossible-travel detection
Regular expressions
Command-and-control pattern recognition
SOAR workflow
Embedded-link analysis

Correct answer: D

Option review:

A: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate a repeatable enrichment-and-response playbook across security tools.

B: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate a repeatable enrichment-and-response playbook across security tools.

C: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate a repeatable enrichment-and-response playbook across security tools.

D: SOAR platforms orchestrate repeatable response steps across tools and can automate enrichment and containment actions. It directly fits this scenario because the requirement is to automate a repeatable enrichment-and-response playbook across security tools.

E: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate a repeatable enrichment-and-response playbook across security tools.

Learning point: Use SOAR workflow when the key requirement is to automate a repeatable enrichment-and-response playbook across security tools.

Question 24

While supporting a global corporate network, an incident coordinator is asked to investigate process execution and isolate a compromised endpoint. Which concept or tool is the clearest match? The team wants the most defensible analyst action before expanding the investigation.

SPF, DKIM, and DMARC validation
Endpoint detection and response (EDR)
Impossible-travel detection
Embedded-link analysis
DNS/IP reputation lookup

Correct answer: B

Option review:

A: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate process execution and isolate a compromised endpoint.

B: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. It directly fits this scenario because the requirement is to investigate process execution and isolate a compromised endpoint.

C: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate process execution and isolate a compromised endpoint.

E: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate process execution and isolate a compromised endpoint.

Learning point: Use Endpoint detection and response (EDR) when the key requirement is to investigate process execution and isolate a compromised endpoint.

Question 25

At Datum Fabrication, a security architect has two simultaneous requirements: evaluate whether an unfamiliar external IP or domain has a suspicious reputation, and identify abnormal account behavior relative to a normal user baseline. Which TWO options should be selected? Select based on the scenario’s decisive constraint, not on which technology is newest.

VirusTotal lookup
Strings analysis
Embedded-link analysis
DNS/IP reputation lookup
User behavior analytics

Correct answers: D, E

Why: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. It directly fits this scenario because the requirement is to evaluate whether an unfamiliar external IP or domain has a suspicious reputation. Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. It directly fits this scenario because the requirement is to identify abnormal account behavior relative to a normal user baseline.

Option review:

A: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether an unfamiliar external IP or domain has a suspicious reputation; identify abnormal account behavior relative to a normal user baseline.

B: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether an unfamiliar external IP or domain has a suspicious reputation; identify abnormal account behavior relative to a normal user baseline.

C: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether an unfamiliar external IP or domain has a suspicious reputation; identify abnormal account behavior relative to a normal user baseline.

E: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. It directly fits this scenario because the requirement is to identify abnormal account behavior relative to a normal user baseline.

Learning point: Use DNS/IP reputation lookup, User behavior analytics when the key requirement is to evaluate whether an unfamiliar external IP or domain has a suspicious reputation; identify abnormal account behavior relative to a normal user baseline.

Question 26

An audit follow-up for a customer-facing service records that the investigation has already ruled out routine administrative activity. To close the finding, the team must quickly inspect a suspicious binary for embedded human-readable indicators. Which option should the analyst recommend?

DNS/IP reputation lookup
Sandbox detonation
SOAR workflow
Strings analysis
Impossible-travel detection

Correct answer: D

Option review:

A: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to quickly inspect a suspicious binary for embedded human-readable indicators.

B: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to quickly inspect a suspicious binary for embedded human-readable indicators.

C: SOAR platforms orchestrate repeatable response steps across tools and can automate enrichment and containment actions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to quickly inspect a suspicious binary for embedded human-readable indicators.

D: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. It directly fits this scenario because the requirement is to quickly inspect a suspicious binary for embedded human-readable indicators.

E: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to quickly inspect a suspicious binary for embedded human-readable indicators.

Learning point: Use Strings analysis when the key requirement is to quickly inspect a suspicious binary for embedded human-readable indicators.

Question 27

In a research enclave, the evidence has been normalized and timestamps are trustworthy. The team has already ruled out unrelated controls and now must check whether a known hash or URL has prior multi-engine detections. Which choice is most defensible?

Strings analysis
SPF, DKIM, and DMARC validation
Embedded-link analysis
SIEM correlation
VirusTotal lookup

Correct answer: E

Option review:

A: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to check whether a known hash or URL has prior multi-engine detections.

B: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to check whether a known hash or URL has prior multi-engine detections.

C: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to check whether a known hash or URL has prior multi-engine detections.

D: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to check whether a known hash or URL has prior multi-engine detections.

E: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. It directly fits this scenario because the requirement is to check whether a known hash or URL has prior multi-engine detections.

Learning point: Use VirusTotal lookup when the key requirement is to check whether a known hash or URL has prior multi-engine detections.

Question 28

For a managed cloud environment, a SOC analyst must satisfy all three needs: observe the runtime behavior of a suspicious file without executing it on a production endpoint; identify whether two files are identical and query known-file intelligence; and extract repeated indicator patterns from large text logs. Select THREE. The organization wants a vendor-neutral approach that can be explained during audit review.

Regular expressions
Sandbox detonation
Hash analysis
Embedded-link analysis
Email-header analysis

Correct answers: A, B, C

Why: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. It directly fits this scenario because the requirement is to extract repeated indicator patterns from large text logs. A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. It directly fits this scenario because the requirement is to observe the runtime behavior of a suspicious file without executing it on a production endpoint. Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. It directly fits this scenario because the requirement is to identify whether two files are identical and query known-file intelligence.

Option review:

A: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. It directly fits this scenario because the requirement is to extract repeated indicator patterns from large text logs.

B: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. It directly fits this scenario because the requirement is to observe the runtime behavior of a suspicious file without executing it on a production endpoint.

C: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. It directly fits this scenario because the requirement is to identify whether two files are identical and query known-file intelligence.

D: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe the runtime behavior of a suspicious file without executing it on a production endpoint; identify whether two files are identical and query known-file intelligence; extract repeated indicator patterns from large text logs.

E: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe the runtime behavior of a suspicious file without executing it on a production endpoint; identify whether two files are identical and query known-file intelligence; extract repeated indicator patterns from large text logs.

Learning point: Use Sandbox detonation, Hash analysis, Regular expressions when the key requirement is to observe the runtime behavior of a suspicious file without executing it on a production endpoint; identify whether two files are identical and query known-file intelligence; extract repeated indicator patterns from large text logs.

Question 29

At Woodgrove Bank, a threat hunter has two simultaneous requirements: recognize traffic behavior consistent with command-and-control check-ins, and automate endpoint or server investigation steps with native command-line tooling. Which TWO options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

Packet capture with Wireshark or tcpdump
Command-and-control pattern recognition
VirusTotal lookup
Strings analysis
PowerShell or shell scripting

Correct answers: B, E

Why: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. It directly fits this scenario because the requirement is to recognize traffic behavior consistent with command-and-control check-ins. PowerShell and shell scripts automate administrative and investigative tasks in their native operating environments. It directly fits this scenario because the requirement is to automate endpoint or server investigation steps with native command-line tooling.

Option review:

A: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recognize traffic behavior consistent with command-and-control check-ins; automate endpoint or server investigation steps with native command-line tooling.

B: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. It directly fits this scenario because the requirement is to recognize traffic behavior consistent with command-and-control check-ins.

C: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recognize traffic behavior consistent with command-and-control check-ins; automate endpoint or server investigation steps with native command-line tooling.

D: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recognize traffic behavior consistent with command-and-control check-ins; automate endpoint or server investigation steps with native command-line tooling.

E: PowerShell and shell scripts automate administrative and investigative tasks in their native operating environments. It directly fits this scenario because the requirement is to automate endpoint or server investigation steps with native command-line tooling.

Learning point: Use Command-and-control pattern recognition, PowerShell or shell scripting when the key requirement is to recognize traffic behavior consistent with command-and-control check-ins; automate endpoint or server investigation steps with native command-line tooling.

Question 30

A detection-engineering review for an identity service starts with this fact: the analyst must choose the narrowest directly applicable technique. The required analyst capability is to determine what an unusual shell or PowerShell command is attempting to do. Which option best aligns?

Endpoint detection and response (EDR)
Suspicious-command interpretation
Embedded-link analysis
Impossible-travel detection
SPF, DKIM, and DMARC validation

Correct answer: B

Option review:

A: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine what an unusual shell or PowerShell command is attempting to do.

B: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. It directly fits this scenario because the requirement is to determine what an unusual shell or PowerShell command is attempting to do.

C: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine what an unusual shell or PowerShell command is attempting to do.

D: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine what an unusual shell or PowerShell command is attempting to do.

E: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine what an unusual shell or PowerShell command is attempting to do.

Learning point: Use Suspicious-command interpretation when the key requirement is to determine what an unusual shell or PowerShell command is attempting to do.

Question 31

At Contoso Health, the response plan has three distinct requirements: trace a suspicious email and inspect sender-routing metadata; parse structured security-tool or API output for automation; and automate a repeatable enrichment-and-response playbook across security tools. Which THREE options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

SOAR workflow
Strings analysis
SPF, DKIM, and DMARC validation
Email-header analysis
JSON or XML parsing

Correct answers: A, D, E

Why: SOAR platforms orchestrate repeatable response steps across tools and can automate enrichment and containment actions. It directly fits this scenario because the requirement is to automate a repeatable enrichment-and-response playbook across security tools. Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. It directly fits this scenario because the requirement is to trace a suspicious email and inspect sender-routing metadata. JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. It directly fits this scenario because the requirement is to parse structured security-tool or API output for automation.

Option review:

B: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to trace a suspicious email and inspect sender-routing metadata; parse structured security-tool or API output for automation; automate a repeatable enrichment-and-response playbook across security tools.

C: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to trace a suspicious email and inspect sender-routing metadata; parse structured security-tool or API output for automation; automate a repeatable enrichment-and-response playbook across security tools.

D: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. It directly fits this scenario because the requirement is to trace a suspicious email and inspect sender-routing metadata.

E: JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. It directly fits this scenario because the requirement is to parse structured security-tool or API output for automation.

Learning point: Use Email-header analysis, JSON or XML parsing, SOAR workflow when the key requirement is to trace a suspicious email and inspect sender-routing metadata; parse structured security-tool or API output for automation; automate a repeatable enrichment-and-response playbook across security tools.

Question 32

The incident worksheet for an endpoint fleet says: the case was escalated after behavior diverged from a 30-day baseline. The next action must directly enable the team to evaluate whether a message passed domain-level sender authentication controls. Which answer should be chosen?

SPF, DKIM, and DMARC validation
Embedded-link analysis
Endpoint detection and response (EDR)
SOAR workflow
Suspicious-command interpretation

Correct answer: A

Option review:

A: SPF authorizes sending hosts, DKIM cryptographically signs messages, and DMARC defines policy using alignment and reporting. It directly fits this scenario because the requirement is to evaluate whether a message passed domain-level sender authentication controls.

B: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether a message passed domain-level sender authentication controls.

C: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether a message passed domain-level sender authentication controls.

D: SOAR platforms orchestrate repeatable response steps across tools and can automate enrichment and containment actions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether a message passed domain-level sender authentication controls.

E: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate whether a message passed domain-level sender authentication controls.

Learning point: Use SPF, DKIM, and DMARC validation when the key requirement is to evaluate whether a message passed domain-level sender authentication controls.

Question 33

a detection engineer at Lucerne Publishing is comparing several approaches. The deciding requirement is to evaluate a suspicious hyperlink embedded in an email. Which option should be chosen? Select based on the scenario’s decisive constraint, not on which technology is newest.

Embedded-link analysis
Python automation
Strings analysis
Regular expressions
VirusTotal lookup

Correct answer: A

Why: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. It directly fits this scenario because the requirement is to evaluate a suspicious hyperlink embedded in an email.

Option review:

A: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. It directly fits this scenario because the requirement is to evaluate a suspicious hyperlink embedded in an email.

B: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate a suspicious hyperlink embedded in an email.

D: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate a suspicious hyperlink embedded in an email.

E: VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to evaluate a suspicious hyperlink embedded in an email.

Learning point: Use Embedded-link analysis when the key requirement is to evaluate a suspicious hyperlink embedded in an email.

Question 34

For case CS0003-T03-Q034, the change board wants a technically specific recommendation. The decision criterion is narrow: the selected option must let the team identify whether two files are identical and query known-file intelligence; and investigate process execution and isolate a compromised endpoint. Which option meets that criterion?

Suspicious-command interpretation
Endpoint detection and response (EDR)
Packet capture with Wireshark or tcpdump
SOAR workflow
Hash analysis

Correct answers: B, E

Why: EDR records endpoint activity and supports detection, investigation, process-tree review, isolation, and response. It directly fits this scenario because the requirement is to investigate process execution and isolate a compromised endpoint. Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. It directly fits this scenario because the requirement is to identify whether two files are identical and query known-file intelligence.

Option review:

A: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify whether two files are identical and query known-file intelligence; investigate process execution and isolate a compromised endpoint.

C: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify whether two files are identical and query known-file intelligence; investigate process execution and isolate a compromised endpoint.

D: SOAR platforms orchestrate repeatable response steps across tools and can automate enrichment and containment actions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify whether two files are identical and query known-file intelligence; investigate process execution and isolate a compromised endpoint.

E: Cryptographic hashes provide repeatable file identifiers for integrity checks and intelligence lookups. It directly fits this scenario because the requirement is to identify whether two files are identical and query known-file intelligence.

Question 35

City Power Utilities is designing a combined control. It must identify abnormal account behavior relative to a normal user baseline, and evaluate whether an unfamiliar external IP or domain has a suspicious reputation. Which TWO options are most appropriate? Assume no additional product-specific features are available beyond the concepts listed.

DNS/IP reputation lookup
Python automation
User behavior analytics
Regular expressions
Packet capture with Wireshark or tcpdump

Correct answers: A, C

Option review:

A: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. It directly fits this scenario because the requirement is to evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

B: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify abnormal account behavior relative to a normal user baseline; evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

C: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. It directly fits this scenario because the requirement is to identify abnormal account behavior relative to a normal user baseline.

D: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify abnormal account behavior relative to a normal user baseline; evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

E: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify abnormal account behavior relative to a normal user baseline; evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

Learning point: Use User behavior analytics, DNS/IP reputation lookup when the key requirement is to identify abnormal account behavior relative to a normal user baseline; evaluate whether an unfamiliar external IP or domain has a suspicious reputation.

Question 36

A security assessment of a cloud landing zone finds that the security lead has separated the immediate requirement from longer-term hardening. Rather than adding a generic control, the organization needs to detect sign-ins from distant locations with insufficient travel time. Which choice is the best fit?

DNS/IP reputation lookup
Impossible-travel detection
Suspicious-command interpretation
Email-header analysis
Embedded-link analysis

Correct answer: B

Option review:

A: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to detect sign-ins from distant locations with insufficient travel time.

C: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to detect sign-ins from distant locations with insufficient travel time.

D: Message headers expose routing, sender infrastructure, authentication results, and other metadata useful for phishing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to detect sign-ins from distant locations with insufficient travel time.

E: Link inspection compares visible text, actual destination, redirects, domain age, and reputation without blindly visiting the site. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to detect sign-ins from distant locations with insufficient travel time.

Learning point: Use Impossible-travel detection when the key requirement is to detect sign-ins from distant locations with insufficient travel time.

Question 37

At Northwind Traders, a security engineer has two simultaneous requirements: parse structured security-tool or API output for automation, and check whether a known hash or URL has prior multi-engine detections. Which TWO options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

JSON or XML parsing
Impossible-travel detection
User behavior analytics
Command-and-control pattern recognition
VirusTotal lookup

Correct answers: A, E

Why: JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. It directly fits this scenario because the requirement is to parse structured security-tool or API output for automation. VirusTotal can compare a file hash, URL, domain, or IP against multiple detection engines and community intelligence. It directly fits this scenario because the requirement is to check whether a known hash or URL has prior multi-engine detections.

Option review:

B: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to parse structured security-tool or API output for automation; check whether a known hash or URL has prior multi-engine detections.

C: Behavior analytics highlights account activity that deviates from a user or peer baseline, such as unusual locations or access patterns. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to parse structured security-tool or API output for automation; check whether a known hash or URL has prior multi-engine detections.

D: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to parse structured security-tool or API output for automation; check whether a known hash or URL has prior multi-engine detections.

Learning point: Use JSON or XML parsing, VirusTotal lookup when the key requirement is to parse structured security-tool or API output for automation; check whether a known hash or URL has prior multi-engine detections.

Question 38

The SOC runbook for a segmented server network is being corrected after this observation: the response team is documenting why one control is more direct than the alternatives. The updated step must help analysts write a cross-platform script to enrich indicators through an API. Which option belongs in the runbook?

Strings analysis
Python automation
Suspicious-command interpretation
JSON or XML parsing
PowerShell or shell scripting

Correct answer: B

Option review:

A: Extracting printable strings from a file can reveal URLs, paths, commands, names, or configuration clues without executing it. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to write a cross-platform script to enrich indicators through an API.

B: Python is well suited to portable scripts for enrichment, parsing, API calls, and repetitive security analysis. It directly fits this scenario because the requirement is to write a cross-platform script to enrich indicators through an API.

C: Reviewing command lines can reveal discovery, persistence, credential access, defense evasion, or data staging activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to write a cross-platform script to enrich indicators through an API.

D: JSON and XML are structured data formats commonly used by APIs, logs, feeds, and security-tool integrations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to write a cross-platform script to enrich indicators through an API.

E: PowerShell and shell scripts automate administrative and investigative tasks in their native operating environments. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to write a cross-platform script to enrich indicators through an API.

Learning point: Use Python automation when the key requirement is to write a cross-platform script to enrich indicators through an API.

Question 39

Coho Winery is designing a combined control. It must automate endpoint or server investigation steps with native command-line tooling, and recognize traffic behavior consistent with command-and-control check-ins. Which TWO options are most appropriate? Use the choice that most directly addresses the stated evidence rather than a broader control.

PowerShell or shell scripting
Command-and-control pattern recognition
Impossible-travel detection
Regular expressions
Sandbox detonation

Correct answers: A, B

Why: PowerShell and shell scripts automate administrative and investigative tasks in their native operating environments. It directly fits this scenario because the requirement is to automate endpoint or server investigation steps with native command-line tooling. Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. It directly fits this scenario because the requirement is to recognize traffic behavior consistent with command-and-control check-ins.

Option review:

A: PowerShell and shell scripts automate administrative and investigative tasks in their native operating environments. It directly fits this scenario because the requirement is to automate endpoint or server investigation steps with native command-line tooling.

C: Impossible travel flags geographically distant sign-ins occurring too close together to be physically plausible. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate endpoint or server investigation steps with native command-line tooling; recognize traffic behavior consistent with command-and-control check-ins.

D: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate endpoint or server investigation steps with native command-line tooling; recognize traffic behavior consistent with command-and-control check-ins.

E: A malware sandbox executes suspicious content in an isolated environment to observe processes, network calls, file changes, and other behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to automate endpoint or server investigation steps with native command-line tooling; recognize traffic behavior consistent with command-and-control check-ins.

Learning point: Use PowerShell or shell scripting, Command-and-control pattern recognition when the key requirement is to automate endpoint or server investigation steps with native command-line tooling; recognize traffic behavior consistent with command-and-control check-ins.

Question 40

Case CS0003-T03-Q040 concerns a newly merged subsidiary. a SIEM case opened after a baseline deviation. The one outcome that matters for this decision is to extract repeated indicator patterns from large text logs. Which option most directly meets that requirement?

Command-and-control pattern recognition
Packet capture with Wireshark or tcpdump
SIEM correlation
DNS/IP reputation lookup
Regular expressions

Correct answer: E

Option review:

A: Recurring callbacks, unusual destinations, or protocol patterns can reveal command-and-control behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to extract repeated indicator patterns from large text logs.

B: Packet capture preserves network conversations for protocol, session, header, payload, and timing analysis. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to extract repeated indicator patterns from large text logs.

C: A SIEM centralizes and correlates logs so analysts can search across systems and connect related events. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to extract repeated indicator patterns from large text logs.

D: WHOIS and reputation services help identify ownership, registration, and abuse history of domains and IP addresses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to extract repeated indicator patterns from large text logs.

E: Regular expressions match text patterns and are useful for filtering logs, extracting indicators, and validating structured strings. It directly fits this scenario because the requirement is to extract repeated indicator patterns from large text logs.

Learning point: Use Regular expressions when the key requirement is to extract repeated indicator patterns from large text logs.

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Question 31

Question 32

Question 33

Question 34

Question 35

Question 36

Question 37

Question 38

Question 39

Question 40

Related posts: