A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?
Option A is the only vector that combines Privileges Required: None (PR:N) and User Interaction: None (UI:N) with a network attack vector and a high confidentiality impact, which matches an actively exploited flaw that needs no user action or privilege escalation. Option B requires high privileges and user interaction, option C has no integrity impact and a high availability impact, and option D requires user interaction and has a high availability impact. Each of B, C and D contradicts the description on more than one metric, so A is the closest fit.
Which of the following tools would work best to prevent the exposure of PII outside of an organization?
A.PAM
B.IDS
C.PKI
D.DLPCorrect
Explanation
Data loss prevention (DLP) inspects data in use, in motion and at rest, and can block or quarantine content such as PII before it leaves the organization through email, web uploads or removable media. PAM controls privileged account access, an IDS only detects and alerts on suspicious traffic, and PKI provides certificates for encryption and authentication; none of these identifies and stops sensitive data from leaving.
An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:
Which of the following tuning recommendations should the security analyst share?
A.Set an HttpOnly flag to force communication by HTTPS
B.Block requests without an X-Frame-Options header
C.Configure an Access-Control-Allow-Origin header to authorized domainsCorrect
D.Disable the cross-origin resource sharing header
Explanation
The most frequent finding in the scan is Cross-Domain Misconfiguration (34 instances), which means the site's CORS policy, usually an Access-Control-Allow-Origin header set to *, lets any origin read its responses. Restricting Access-Control-Allow-Origin to an allowlist of authorized domains fixes this while keeping legitimate cross-origin use working. HttpOnly stops scripts from reading cookies and does not force HTTPS (that is the Secure flag), X-Frame-Options is a response header the server sends rather than something to require on requests, and disabling CORS entirely would break legitimate cross-origin access.
Which of the following items should be included in a vulnerability scan report? (Choose two.)
A.Lessons learned
B.Service-level agreement
C.Playbook
D.Affected hostsCorrect
E.Risk scoreCorrect
F.Education plan
Explanation
A vulnerability scan report lists each finding with the affected hosts and a risk or severity score so that remediation can be assigned and prioritized. Lessons learned belong to an incident post-mortem, a playbook is an incident response procedure, an SLA is a contractual document, and an education plan is a training artifact; none is part of the scan output.
The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?
A.A mean time to remediate of 30 daysCorrect
B.A mean time to detect of 45 days
C.A mean time to respond of 15 days
D.Third-party application testing
Explanation
If attackers typically exploit a vulnerability about 45 days after the patch is released, the organization is protected when it applies patches faster than that, and a mean time to remediate of 30 days closes the gap before exploitation starts. Mean time to detect and mean time to respond measure how quickly the team notices and reacts to an incident, which only helps after exploitation has begun. Third-party application testing does not shorten patching time.
A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:
```
foreach ($user in Get-Content .\this.txt)
{
Get-ADUser $user -Properties primaryGroupID |select-object primaryGroupID
Add-ADGroupMember "Domain Users" -Members $user
Set-ADUser $user -Replace @{primaryGroupID=513}
}
```
Which of the following scripting languages was used in the script?
A.PowerShellCorrect
B.Ruby
C.Python
D.Shell script
Explanation
The script uses PowerShell verb-noun cmdlets (Get-Content, Get-ADUser, Add-ADGroupMember, Set-ADUser, Select-Object), $-prefixed variables, the pipeline into Select-Object and the @{} hashtable syntax, all of which are PowerShell. Ruby and Python do not use these cmdlets or $variable syntax, and a Unix shell script would not call Active Directory cmdlets or use @{} hashtables.
A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP; other times, it is accessible through HTTPS. Which of the following most likely describes the observed activity?
A.There is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access
B.An on-path attack is being performed by someone with internal access that forces users into port 80Correct
C.The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80
D.An error was caused by BGP due to new rules applied over the company's internal routers
Explanation
Intermittent downgrades from HTTPS to HTTP combined with compromised accounts point to an on-path (SSL stripping) attack: an attacker inside the network intercepts traffic, serves the portal over plain HTTP on port 80 and captures credentials in clear text. A certificate problem would produce browser errors rather than silent HTTP access, web servers do not fall back to HTTP under load, and BGP changes affect routing between networks, not the protocol a user sees.
A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below:
Security Policy 1006: Vulnerability Management
1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.
2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.
3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.
According to the security policy, which of the following vulnerabilities should be the highest priority to patch?
A.Name: THOR.HAMMER - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Internal System
C.Name: LOKI.DAGGER - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - External System
D.Name: THANOS.GAUNTLET - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Internal System
Explanation
All four vulnerabilities have identical exploitability metrics, so the policy's tie-breakers decide. Rule 2 prefers a confidentiality impact over an availability impact, and rule 3 prefers externally available systems, so CAP.SHIELD (C:H on an external system) satisfies both. LOKI.DAGGER is external but only affects availability, while THOR.HAMMER and THANOS.GAUNTLET are internal systems.
Which of the following will most likely ensure that mission-critical services are available in the event of an incident?
A.Business continuity planCorrect
B.Vulnerability management plan
C.Disaster recovery plan
D.Asset management plan
Explanation
A business continuity plan sets out how an organization keeps its mission and business processes running during and after a significant disruption, so it is what keeps mission-critical services available during an incident. A disaster recovery plan focuses on restoring IT systems and data after a disaster, which is a narrower, after-the-fact scope that supports continuity rather than ensuring it. Vulnerability management and asset management plans reduce risk and track resources but do not keep services running during an incident.
The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?
A.Deploy a CASB and enable policy enforcementCorrect
B.Configure MFA with strict access
C.Deploy an API gateway
D.Enable SSO to the cloud applications
Explanation
A cloud access security broker (CASB) discovers the cloud applications users actually access, rates their risk, and lets the organization enforce policies such as blocking or restricting unsanctioned high-risk apps, which directly reduces shadow IT. MFA and SSO strengthen authentication only for applications the organization already manages, so they do nothing about unsanctioned apps. An API gateway manages traffic to the organization's own APIs, not employee use of third-party cloud services.
An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review first?
A.CDN
B.Vulnerability scanner
C.DNSCorrect
D.Web server
Explanation
When users in every location suddenly cannot reach any external SaaS resource, the shared dependency is name resolution, and DNS is a frequent DDoS target (query floods and DNS amplification). The DNS logs show the flood of queries, failed resolutions and the sources involved, so they are the first place to confirm the attack's scope. CDN and web server logs cover the organization's own published content, not users' outbound access to external services, and a vulnerability scanner log does not record attack traffic.
A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?
A.Weaponization
B.Reconnaissance
C.Delivery
D.ExploitationCorrect
Explanation
In the Cyber Kill Chain, reconnaissance, weaponization and delivery all happen before the attacker gets in; once the social engineering lure has worked and the actor has gained access to the network, the attack has reached exploitation. Of the options given, exploitation is the only stage that matches an actor who already has a foothold and is working to keep it. Reconnaissance is information gathering, weaponization is building the payload, and delivery is sending it to the target, all of which are already complete here.
An analyst finds that an IP address outside of the company network is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?
A.Exploitation
B.ReconnaissanceCorrect
C.Command and control
D.Actions on objectives
Explanation
Scanning external-facing assets for open ports, services and vulnerabilities is information gathering, which is the reconnaissance step of attack frameworks such as the Cyber Kill Chain. Exploitation would involve actually using a flaw to gain access, command and control requires a compromised host communicating with the attacker, and actions on objectives is the final goal, such as data theft, none of which is happening yet.
An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.)
A.Beaconing
B.Domain Name System hijacking
C.Social engineering attackCorrect
D.On-path attack
E.Obfuscated linksCorrect
F.Address Resolution Protocol poisoning
Explanation
Emails aimed only at administrators that try to lure them to a malicious site are a targeted social engineering attack (spear phishing). A concealed URL that hides its real destination is an obfuscated link. Beaconing is periodic outbound traffic from an already infected host, and DNS hijacking, on-path attacks and ARP poisoning tamper with network traffic or name resolution, none of which the emails themselves show.
During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?
A.Conduct regular red team exercises over the application in production
B.Ensure that all implemented coding libraries are regularly checked
C.Use application security scanning as part of the pipeline for the CI/CD flowCorrect
D.Implement proper input validation for any data entry form
Explanation
Building application security scanning (such as SAST and DAST) into the CI/CD pipeline catches vulnerabilities on every build, before code reaches production, so recurring flaws are stopped across the SDLC rather than rediscovered later. Red team exercises in production find problems only after release. Checking libraries and adding input validation each address one class of flaw, not the recurring vulnerabilities in general.
An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?
A.Proprietary systemsCorrect
B.Legacy systems
C.Unsupported operating systems
D.Lack of maintenance windows
Explanation
A vendor appliance the company cannot access is a proprietary system: only the vendor can patch it, so the organization cannot remediate the vulnerabilities itself, which is an inhibitor to remediation listed in the CySA+ objectives. Nothing says the systems are old or out of support, so legacy systems and unsupported operating systems do not fit. A maintenance window is available, since the other systems can be upgraded in a single downtime window.
The security team reviews a web server for XSS and runs the following Nmap scan:
```
#nmap -p80 --script http-unsafe-output-escaping 172.31.15.2
PORT STATE SERVICE REASON
80/tcp open http syn-ack
| http-unsafe-output-escaping:
|_ Characters [> " '] reflected in parameter id at http://172.31.15.2/1.php?id=2
```
Which of the following most accurately describes the result of the scan?
A.An output of characters > and " as the parameters used in the attempt
B.The vulnerable parameter ID http://172.31.15.2/1.php?id=2 and unfiltered characters returned
C.The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe
D.The vulnerable parameter and characters > and " with a reflected XSS attemptCorrect
Explanation
The http-unsafe-output-escaping script finds parameters whose values are reflected in the page, submits a test string containing special characters and reports which characters come back without HTML escaping. The output names the vulnerable parameter (id on 1.php) and the characters > and " that were reflected unescaped, which is a reflected XSS test. The characters are not the parameters themselves, the URL is not the parameter ID, and the characters were reflected unencoded rather than encoded.
Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?
A.Develop a call tree to inform impacted users
B.Schedule a review with all teams to discuss what occurredCorrect
C.Create an executive summary to update company leadership
D.Review regulatory compliance with public relations for official notification
Explanation
A lessons-learned review with all involved teams is the post-incident activity designed to improve future incident response: it examines what happened, what worked and what should change in procedures and tools. A call tree and regulatory notification are communication tasks during the incident, and an executive summary informs leadership but does not by itself improve the process.
A security analyst received a malicious binary file to analyze. Which of the following is the best technique to perform the analysis?
A.Code analysis
B.Static analysis
C.Reverse engineeringCorrect
D.Fuzzing
Explanation
A compiled binary has no readable source code, so understanding what it does requires reverse engineering: disassembling or decompiling it and observing its behavior to recover its logic. Static analysis is one part of that work but on its own only inspects the file without revealing its full behavior, code analysis assumes access to source code, and fuzzing feeds malformed input to find bugs rather than analyzing malware.
An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?
A.Hard disk
B.Primary boot partition
C.Malicious files
D.Routing tableCorrect
E.Static IP address
Explanation
Evidence should be collected in order of volatility, most volatile first. The routing table is volatile and changes or is lost when the server is isolated from the network or powered down, so it must be captured first. The hard disk, boot partition and files on disk persist and can be imaged later, and a static IP address is configuration that does not change on isolation.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.
