312-39v2 Practice Test practice questions, page 5 of 8, with answer review and explanations.
Question 21
During a routine security audit, analysts discover that several of the organization's web servers are still using a vulnerable third-party library flagged for a zero-day exploit. This vulnerability was identified in a previous audit, and patches were initially deployed to mitigate the risk. However, due to reported application instability and compatibility issues, the application team rolled back the patches, leaving the systems exposed. Despite the known risk, the vulnerability remains unaddressed, and no alternative mitigations have been put in place. Given the state of the web servers and their reliance on outdated, vulnerable software, how should the security team classify this risk in the context of web application security?
Vulnerable and Outdated Components
Software and Data Integrity Failures
Security Logging and Monitoring Failures
Insecure Design
Question 22
The SOC team at a national cybersecurity agency has detected anomalous network traffic originating from a sensitive government server. Initial analysis suggests a potential intrusion, leading the SOC team to escalate the incident to the forensic team for deeper investigation. Upon forensic examination, the team discovers a trojan on the compromised server. The trojan is suspected of engaging in data exfiltration, raising concerns about potential backdoor access and long-term persistence mechanisms employed by the malware. Given the severity of the situation, the lead malware analyst is tasked with conducting an in-depth analysis of the trojan to determine its capabilities (e.g., command execution, privilege escalation, keylogging), its persistence mechanisms (e.g., registry modifications, scheduled tasks, startup entries), and any backdoor functionalities (e.g., remote access, hidden communication channels). However, due to the sensitive nature of the system and the risk of unintended execution, the analyst must analyze the trojan's binary code at the instruction level without actually executing it. Which technique should the forensic analyst use?
Malware Disassembly
Network Behavior Monitoring
Dynamic Code Injection
Interactive Debugging
Question 23
A SOC team at a major financial institution detects unauthorized access attempts on its web application. The security team reviews the logs to find the web application is compromised. To determine the exact attack technique used and implement necessary mitigation measures, the forensic investigators is assessing cookie attributes (such as HttpOnly, Secure, and SameSite) for security weaknesses, and track anomalous request patterns that deviate from normal user behavior. Which of the following attack vectors is the forensic team investigating in the above investigation?
SQL Injection
Cross-Site Scripting (XSS)
Man-in-the-Middle (MITM) Attack
Session Poisoning
Question 24
A security operations center (SOC) team is investigating a phishing attack that targeted multiple employees. During the Containment Phase, they need to determine how users interacted with the malicious email, whether they opened it, clicked on links, downloaded attachments, or entered credentials. This information is critical to assessing the impact and preventing further compromise. Which specific activity helps the SOC team understand user interactions with the phishing email?
User action verification.
Blocking C2 and email traffic.
Monitoring and containment validation.
Malware infection check.
Question 25
Lisa Carter, a SOC analyst at a financial services firm, is performing a risk assessment following a series of suspicious alerts detected by the SIEM (Security Information and Event Management) system. Her task is to evaluate the risk of a potential data breach prioritizing incident response efforts. She assesses three key factors: the likelihood of an attack succeeding based on current threat intelligence, the impact on critical business operations if the breach occurs, and the value of the assets targeted (e.g., customer data, financial systems). Using the standard risk assessment formula, which of the following scenarios represents the highest risk to the organization?