312-50v13 Practice Test practice questions, page 35 of 42, with answer review and explanations.
Question 171
Olivia works as a senior red team specialist at SecureMatrix Labs in Portland, Oregon. During a controlled adversarial simulation, she deployed a stealth persistence mechanism on a test workstation to evaluate advanced defensive detection capabilities. After rebooting the system, the operating system continued to function normally, but subsequent investigation revealed that the OS was executing within an underlying control layer established before full system initialization. This layer intercepted low-level CPU instructions and mediated direct hardware interactions prior to their delivery to the operating system. Which type of rootkit best describes the mechanism deployed in this scenario?
Application-Level/User-Mode Rootkit
Kernel-Level Rootkit
Hypervisor-Level Rootkit
Boot-Loader-Level Rootkit
Question 172
A large online retail platform in Seattle, Washington, maintains continuous telemetry of inbound network flows to detect abnormal surges that may indicate a distributed denial-of-service condition. During a recent monitoring exercise, the security engineering team implemented a statistical mechanism that continuously evaluates streaming traffic metrics and mathematically determines the exact point at which normal behavior shifts into an anomalous state. Rather than comparing traffic against static baselines or clustering historical profiles, the system dynamically identifies the precise moment when distribution characteristics deviate beyond an established threshold. This approach is designed to flag sudden structural changes in traffic behavior in near real time, even if the overall traffic volume appears similar to prior peaks. Which detection technique is being applied in this scenario?
Wavelet-Based Signal Analysis
Traffic Pattern Analysis
Activity Profiling
Sequential Change-Point Detection
Question 173
During an authorized security assessment at a municipal power distribution facility in Omaha, Nebraska, a certified ethical hacker performs passive traffic analysis between the control center and several remote substations. The tester observes structured request-response messages used to read coil status and write register values on industrial controllers. All communication occurs over TCP port 502, and the protocol does not provide built-in encryption or authentication. Based on these characteristics, which OT communication protocol is operating within this environment?
IEC 60870-S-104
MODBUS
DNP3
OPC UA
Question 174
During an internal investigation at a healthcare billing firm in Denver, Colorado, the security team analyzes suspicious activity involving a senior accountant's corporate smartphone. The user reports that the device behaved normally and that no links were clicked or applications installed during the timeframe in question. Telecom monitoring reveals that the device received several binary-formatted SMS messages shortly before the incident. These messages were not visible in the messaging application. Within minutes of receiving them, the phone began transmitting cellular location identifiers and device-related data to an unfamiliar external system. The transmissions occurred automatically and did not require any user interaction. Which mobile attack technique most accurately explains this behavior?
Call Spoofing
QTP Hijacking
SMiShing
SIMjacker
Question 175
A multinational manufacturing company in San Jose, California has deployed a perimeter firewall to protect its internal production networks. During a red team exercise, testers observe that the device monitors active TCP communications and allows traffic to continue only when packets correspond to recognized, previously established connections. The firewall evaluates multiple header attributes across ongoing communications while operating inline at the network boundary. From a firewall architecture perspective, what type of Firewall is most likely in use at this perimeter?