Security Operations and Monitoring CISA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A user reports that their computer is running slowly and displaying pop-up advertisements. The security team finds an unknown process running and network connections to known ad servers. Which type of malware is most likely?

   • AWorm
   • BRansomware
   • CTrojan horse
   • DAdware
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of a social engineering attack?

   • AAn attacker exploits a vulnerability in a web application to gain unauthorized access
   • BAn attacker installs a keylogger on a user's computer to record keystrokes
   • CAn attacker sends a phishing email that appears to be from a trusted source to trick a user into revealing credentials
   • DAn attacker uses a packet sniffer to capture unencrypted network traffic
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following best describes a distributed denial-of-service (DDoS) attack?

   • AAn attacker sends a single large packet to a server to crash it
   • BMalicious software is used to encrypt a victim's data and demand payment for decryption
   • CMultiple compromised systems are used to flood a target with traffic, overwhelming its resources
   • DAn attacker intercepts and modifies communication between two parties without their knowledge
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is planning a penetration test of its external-facing web application. The test must not cause any disruption to production services. Which testing approach is most appropriate?

   • ATest only during maintenance windows
   • BRun a full penetration test with active exploitation during business hours
   • CUse a penetration testing tool with aggressive payloads
   • DPerform a passive vulnerability scan and manual review
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is reviewing logs and finds that a user account was used to log in from two different geographic locations within a 10-minute period. The user is known to travel frequently. Which action should the analyst take?

   • ABlock the IP addresses involved
   • BContact the user to verify the logins
   • CDisable the account immediately
   • DIgnore the alert because the user travels
   Reveal Solution Discussion Select an answer first