1. A cybersecurity analyst has received an alert that well-known call home messages are continuously observed by network sensors at the network boundary. Theproxy firewall successfully drops the messages. After determining the alert was a true positive, which of the following represents the MOST likely cause?

A) An outside command and control system is attempting to reach an infected system.
B) Malware is running on a company system.
C) An insider is trying to exfiltrate information to a remote network.
D) Attackers are running reconnaissance on company resources.



2. Which of the allowing is a best practice with regard to interacting with the media during an incident?

A) Designate a single port of contact and at least one backup for contact with the media.
B) Allow any senior management level personnel with knowledge of the incident to discuss it.
C) Stipulate that incidents are not to be discussed with the media at any time during the incident.
D) Release financial information on the impact of damages caused by the incident.



3. A cybersecurity analyst has been asked to follow a corporate process that will be used to manage vulnerabilities for an organization. The analyst notices the policyhas not been updated in three years. Which of the following should the analyst check to ensure the policy is still accurate?

A) Technical constraints
B) Corporate minutes
C) Threat intelligence reports
D) Governing regulations



4. In reviewing firewall logs, a security analyst has discovered the following IP address, which several employees are using frequently:152.100.57.18The organizations servers use IP addresses in the 192.168.0.1/24 CIDR. Additionally, the analyst has noticed that corporate data is being stored at this newlocation. A few of these employees are on the management and executive management teams. The analyst has also discovered that there is no record of this IPaddress or service in reviewing the known locations of managing system assets. Which of the following is occurring in this scenario?

A) Unauthorized access
B) Malicious process
C) Data exfiltration
D) Unauthorized change



5. Which of the following BEST describes the offensive participants in a tabletop exercise?

A) Operations team
B) Blue team
C) Red team
D) Security analysts
E) System administrators