An international insurance provider observed a sharp rise in endpoint infections across geographically dispersed offices. The IR team correlated the infections with recent access to a series of trusted informational websites visited during routine research activities. After cross-referencing network telemetry and endpoint logs, analysts uncovered that these sites had been covertly altered by threat actors to include obfuscated scripts that launched on page render. Upon visiting the tampered content, a series of exploit chains were executed, targeting unpatched vulnerabilities in rendering engines of commonly used client applications. The malicious code was injected directly into volatile memory, allowing the payload to operate stealthily without initiating file creation events or prompting user interaction. Security tools failed to detect the compromise in real time due to the absence of conventional indicators such as user-triggered executions or external file transfers. Which web-based malware delivery technique is MOST consistent with the described attack?

A global bank ' s IH & R team is investigating an intricate cyber-espionage campaign. Advanced persistent threat (APT) actors exfiltrated sensitive financial data over several months using both software vulnerabilities and human errors. What is the MOST appropriate immediate action for the IH & R team?

Which one of the following is Inappropriate Usage Incidents?

In an international bank, the IT security team identified unusual network traffic indicating a potential malware infection. Further analysis revealed that several high-value transaction servers were communicating with an external command-and-control server. The team needs to decide the immediate action to best handle this malware incident triage. What should they prioritize to mitigate the threat and safeguard sensitive data effectively?

Which of the following is the BEST method to prevent email incidents?

EcoEarth Inc. detects abnormal archival data access from dormant employee profiles, modification of critical datasets, and suspicious encrypted packet transmissions. Given the risk, what is the first responder’s primary action?

Attackers or insiders create a backdoor into a trusted network by installing an unsecured access point inside a firewall. They then use any software or hardware access point to perform an attack. Which of the following is this type of attack?

Francis received a spoof email asking for his bank information. He decided to use a tool to analyze the email headers. Which of the following should he use?

Aarav, an IT support specialist, identifies that multiple employees have engaged with an email promoting free shopping vouchers, which appears suspicious. To minimize the potential threat, he instructs staff to report the message, classify it as junk, and remove it from their inboxes. He further advises them not to interact with similar messages in the future, even if they seem to come from internal contacts. Which best practice is Aarav reinforcing?

Khai was tasked with examining the logs from a Linux email server. The server uses Sendmail to execute the command to send emailsand Syslog to maintain logs. To validate the data within email headers, which of the following directories should Khai check for information such as source and destination IP addresses, dates, and timestamps?

During a security audit, analysts identified unusual GET requests to a financial application where external resources were fetched using numeric IPs combined with unexpected trailing characters. These inputs were not properly filtered by the system, allowing external content to be processed and embedded in server responses. The issue was traced to a feature that dynamically loads input-specified content without strict validation. Which type of attack/technique is most likely being analyzed in this scenario?

Which of the following GPG18 and Forensic readiness planning (SPF) principles states

that “organizations should adopt a scenario based Forensic Readiness Planning

approach that learns from experience gained within the business”?

SevTech, a top-notch security provider, recently detected inconsistencies in its client data protection module. Upon closer inspection, it appeared that a sophisticated actor had injected malicious code by exploiting a previously unknown vulnerability. This potentially jeopardized the data integrity of hundreds of SevTech ' s clients. Complicating matters, initial indicators suggest the involvement of a nation-state actor. In this high-pressure scenario, what should be SevTech ' s primary course of action?

Eve’s is an incident handler in ABC organization. One day, she got a complaint about email hacking incident from one of the employees of the organization. As a part of

incident handling and response process, she must follow many recovery steps in order to recover from incident impact to maintain business continuity.

What is the first step that she must do to secure employee account?

Which of the following information security personnel handles incidents from management and technical point of view?

A US Federal Agency network was the target of a DoS attack that prevented and

impaired the normal authorized functionality of the networks. According to agency’s

reporting timeframe guidelines, this incident should be reported within 2 h of

discovery/detection if the successful attack is still ongoing and the agency is unable to

successfully mitigate the activity.

Which incident category of US Federal Agency does this incident belong to?

Oscar receives an email from an unknown source containing his domain name oscar.com. Upon checking the link, he found that it contains a malicious URL that redirects to the website evilsite.org. What type of vulnerability is this?

Which of the following digital evidence temporarily stored on a digital device that

requires a constant power supply and is deleted if the power supply is interrupted?

Malicious Micky has moved from the delivery stage to the exploitation stage of the kill chain. This malware wants to find and report to the command center any useful services on the system. Which of the following recon attacks is the MOST LIKELY to provide this information?

Joseph is an incident handling and response (IH & R) team lead in Toro Network Solutions Company. As a part of IH & R process, Joseph alerted the service providers,

developers, and manufacturers about the affected resources.

Identify the stage of IH & R process Joseph is currently in.

SafePay, an online payment portal, recently introduced an advanced search feature allowing users to search for their transaction history. A week later, an alarming number of users reported unauthorized transactions. Investigation showed that attackers were using advanced search strings, exploiting a previously unidentified vulnerability. What is SafePay ' s best immediate action?

A large retail company recently migrated its customer data to a public cloud service. Shortly after, they noticed suspicious activities indicating a potential data breach. The incident response team faces multiple challenges due to the cloud ' s shared responsibility model, including limited access to underlying infrastructure and logs. Which action is most critical for the incident response team to perform first?

Which of the following is an Inappropriate usage incident?

Jason is setting up a computer forensics lab and must perform the following steps: 1. physical location and structural design considerations; 2. planning and budgeting; 3. work area considerations; 4. physical security recommendations; 5. forensic lab licensing; 6. human resource considerations. Arrange these steps in the order of execution.

Which of the following is a term that describes the combination of strategies and services intended to restore data, applications, and other resources to the public cloud or dedicated service providers?

During a routine investigation, Daniel, a threat analyst, notices repetitive failed login attempts in server logs with HTTP POST requests and status code 200 across several entries. At log entry 117, a 302 redirect status is recorded for the same user account. What type of attack is this indicative of?

Which of the following risk management processes identifies the risks, estimates the impact, and determines sources to recommend proper mitigation measures?

Francis is an incident handler and security expert. He works at MorisonTech Solutions based in Sydney, Australia. He was assigned a task to detect phishing/spam mails for the client organization.

Which of the following tools can assist Francis to perform the required task?

An AWS user notices unusual activity in their EC2 instances, including unexpected outbound traffic. When suspecting a security compromise, what is the most effective immediate step to take to contain the incident?

Sophia, an incident handler at a cloud hosting provider, is investigating reports of intermittent web server slowdowns and timeouts. Upon analyzing router logs, she finds an unusually high number of incomplete connection attempts, causing the server’s memory and CPU resources to spike. Suspecting a form of resource exhaustion attack, she applies a protective configuration to the router that allows it to validate connection requests before they reach the server. Soon after this change, the number of partial connections decreases, and the server regains stable performance. What was the purpose of this action?

Which of the following terms refers to vulnerable account management functions, including account update, recovery of forgotten or lost passwords, and password reset, that might weaken valid authentication schemes?

A malicious, security-breaking program is disguised as a useful program. Such executable programs, which are installed when a file is opened, allow others to control a user ' s system. What is this type of program called?

Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket submitted regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he performed incident analysis and validation to check whether the incident is a genuine incident or a false positive.

Identify the stage he is currently in.

A colleague wants to minimize their security responsibility because they are in a small organization. They are evaluating a new application that is offered in different forms. Which form would result in the least amount of responsibility for the colleague?

Liam, a certified digital forensics technician, labels seized laptops, USB drives, and smartphones with exhibit tags, records detailed descriptions in an evidence logbook, photographs items in their original positions, and documents custody transfers. Which aspect of evidence handling is Liam demonstrating?

A national research agency was recently subjected to a comprehensive cybersecurity compliance audit. During the audit, reviewers evaluated how the agency ' s incident response unit manages harmful code samples during investigations. The assessment revealed that team members often interacted with dangerous file payloads directly on enterprise-connected systems used for general operations. Furthermore, no precautionary renaming was applied to prevent accidental triggering, and sensitive materials were placed in areas accessible by non-specialized personnel. The auditors flagged these practices as severely noncompliant with safe sample processing protocols and recommended urgent changes to prevent operational fallout or accidental outbreaks. Which best practice for secure handling of malicious code was most clearly disregarded in this case?

Elizabeth, who works for OBC organization as an incident responder, is assessing the risks to the organizational security. As part of the assessment process, she is calculating the probability of a threat source exploiting an existing system vulnerability. Which of the following risk assessment steps is Elizabeth currently in?

AlphaTech, a technology firm, recently discovered signs of an advanced persistent threat (APT) in its infrastructure. The incident response team is trying to gather more information about the threat to form a comprehensive response strategy. While leveraging threat intelligence platforms, which of the following approaches would be most effective in gathering detailed and actionable insights about the APT to improve the firm ' s defense against such threats?

A cybersecurity analyst at a technology firm discovers suspicious activity on a network segment dedicated to research and development. The initial indicators suggest a possible compromise of several endpoints with potential intellectual property theft. Given the sensitive nature of the data involved, what is the most effective method for the analyst to detect and validate the security incident?

You are a systems administrator for a company. You are accessing your file server remotely for maintenance. Suddenly, you are unable to access the server. After contacting others in your department, you find out that they cannot access the file server either. You can ping the file server but not connect to it via RDP. You check the Active Directory Server, and all is well. You check the email server and find that emails are sent and received normally. What is the most likely issue?

Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case,

he needs to collect volatile information such as running services, their process IDs,

startmode, state, and status.

Which of the following commands will help Clark to collect such information from

running services?

Following an upgrade in their global communication systems, NewsNet Corp., a media conglomerate, experienced anomalies. Subsequent analysis revealed malware that subtly altered news content, skewing information. Having an AI-based content checker and a network segregation tool, what is the immediate approach?

Elena, a first responder at a multinational firm, receives multiple reports from employees claiming they were asked to update their payroll information through an email that appears to be from HR. The email includes a URL directing users to a login page identical to the company ' s intranet but hosted on an unfamiliar domain. Elena immediately informs the IH & R team, preserves the email headers, captures screenshots of the spoofed page, and blocks the domain at the network level. What type of email security incident is Elena handling?

During a security audit, analysts identified unusual GET requests to a financial application where external resources were fetched using numeric IP addresses combined with unexpected trailing characters. These inputs were not properly filtered by the system, allowing external content to be processed and embedded in server responses. The issue was traced to a feature that dynamically loads input-specified content without strict validation. Which type of attack/technique is most likely being analyzed in this scenario?

A large insurance enterprise recently completed an internal phishing simu-lation to evaluate its incident reporting workflow. Upon reviewing the ticketing system logs, the IR lead discovered that several phishing-related reports submitted by employees had been mistakenly logged as routine IT service requests. This misrouting prevented timely review by the IH & R team, delaying appropriate follow-up actions.

The root cause was traced to frontline support staff misinterpreting subtle incident indicators as generic technical issues. Recognizing the potential risk this poses to early issue detection, the Chief Information Security Officer directed an overhaul of the alert-handling procedures. This included refining the reporting workflow, embedding clearer triage rules within the ticketing platform, and initiating refresher training to strengthen tier-one decision-making when handling ambiguous user reports. Which IR concern is being addressed through this corrective action?

Identify Sarbanes–Oxley Act (SOX) Title, which consists of only one section, that includes measures designed to help restore investor confidence in the reporting of

securities analysts.

In response to suspicious communications originating from executive accounts, the organization ' s response team traced the root cause to spoofed identity relays exploiting unsecured DNS entries. The attack had triggered internal alerts but required deeper remediation to eliminate recurring forged message injections and restore the integrity of interdepartmental mail routing. What action reflects an appropriate eradication strategy in this context?

Which of the following methods help incident responders to reduce the false-positive

alert rates and further provide benefits of focusing on topmost priority issues reducing

potential risk and corporate liabilities?

Which of the following best describes an email issued as an attack medium, in which several messages are sent to a mailbox to cause overflow?

A cloud security analyst at a financial institution identifies a complex multi-vector attack targeting their cloud-hosted applications. The attack combines DDoS, phishing, and malware infiltration. In the context of cloud incident handling, what is the most critical challenge the analyst must overcome to respond to this incident effectively?

Bob, an incident responder at CyberTech Solutions, is investigating a cybercrime attack occurred in the client company. He acquired the evidence data, preserved it, and started

performing analysis on acquired evidentiary data to identify the source of the crime and the culprit behind the incident.

Identify the forensic investigation phase in which Bob is currently in.

The following steps describe the key activities in forensic readiness planning:

1. Train the staff to handle the incident and preserve the evidence

2. Create a special process for documenting the procedure

3. Identify the potential evidence required for an incident

4. Determine the source of the evidence

5. Establish a legal advisory board to guide the investigation process

6. Identify if the incident requires full or formal investigation

7. Establish a policy for securely handling and storing the collected evidence

8. Define a policy that determines the pathway to legally extract electronic evidence

with minimal disruption

Identify the correct sequence of steps involved in forensic readiness planning.

BetaCorp, a multinational corporation, identified an employee selling company secrets to competitors. BetaCorp wants to prevent such incidents in the future. Which action will be most effective?

After experiencing a large-scale distributed denial-of-service (DDoS) attack that caused service outages, a national telecom provider recovered its web platform. The IH & R team must now implement post-recovery measures to enhance resilience against future DDoS attempts. Which action would be most effective?

Allan performed a reconnaissance attack on his corporate network as part of a red-team activity. He scanned the IP range to find live host IP addresses. What type of technique did he use to exploit the network?

A network administrator reviews firewall and IDS/IPS configurations to ensure logging is properly set, updates logging to centralize alerts from all network devices, and confirms that all response team members know their responsibilities. Which preparatory activity is he performing?

Following a high-profile breach investigation at a multinational corporation, an incident handler is tasked with the critical role of preserving, packaging, and transporting digital evidence from a server believed to be compromised and utilized as part of a global botnet operation. The challenge lay not only in the technical complexities of the operation but also in adhering to stringent legal and procedural frameworks to ensure the evidence remained admissible in court. Which of the following options ensures the highest level of evidence integrity during its transport?

EnviroTech, a global environmental research institute, faced anomalies in six months of satellite weather data. Unauthorized data modification entries were found in logs, occurring in microbursts with minimal traces. While the intent was unclear, the implications were significant. What ' s the optimal response?

Olivia, a cybersecurity responder at a multinational firm, is alerted late at night by the Network Operations Center (NOC) about unusual latency and degraded performance across several critical applications hosted on the company ' s internal servers. Upon initial inspection, she notices that internal routers are experiencing an unusually high volume of ARP requests being broadcast across the network. Network bandwidth utilization has spiked, and multiple routers are reporting elevated CPU usage.

Further diagnostics show that NAT tables on edge routers are saturated with numerous entries from the same IP range within a short period. These entries initiate simultaneous connections to different ports across various endpoints. Firewall logs show repeated attempts to access unused services, while the ISP reports an overflow of incoming requests from numerous geographic locations. The same pattern is occurring across different branches, indicating a coordinated attempt to overwhelm the systems. What should Olivia suspect?

Which of the following encoding techniques replaces unusual ASCII characters with

" % " followed by the character’s two-digit ASCII code expressed in hexadecimal?

Stenley is an incident handler working for Texa Corp. located in the United States. With the growing concern of increasing emails from outside the organization, Stenley was

asked to take appropriate actions to keep the security of the organization intact. In the process of detecting and containing malicious emails, Stenley was asked to check the

validity of the emails received by employees.

Identify the tools he can use to accomplish the given task.

An international logistics firm runs a smart hub where IT systems interface with warehouse automation for tasks like sorting, routing, and conveyor coordination via programmable units and dashboards. A recent cyberattack, initiated through a compromised third-party remote maintenance tunnel, disrupted communication between backend scheduling applications and embedded automation units, leading to halted processing lines and shipment delays.

After isolating affected segments, removing malicious components, and restoring critical workflows, the recovery team begins validating the reinstated operations. While reviewing logs and configurations, they find excessive permissions granted between internal authentication servers and embedded automation modules. They also detect anomalies in authentication tokens used to verify communications across system interfaces, including unidentified fingerprints not matching the original configuration. Which action should be prioritized as part of a secure restoration plan?

In which of the following phases of incident handling and response (IH & R) process the identified security incidents are analyzed, validated, categorized, and prioritized?

MegaHealth, a global healthcare provider, experienced a sudden malfunction in its MRI machines. Investigations revealed malware that tweaked MRI results and communicated with an external command-and-control server. With tools like an advanced endpoint protection system and a network monitor, what should be the first step?

Following an internal audit at a mid-sized software development firm, it was discovered that several employees had been sharing system login credentials using personal messaging applications that were not approved by the organization. The audit further revealed that no structured guidance, awareness training, or acceptable usage policies had been provided regarding how and where confidential organizational information should be transmitted. Which of the following preparation steps would have most effectively prevented this situation?

Following a security alert, the incident response team at a legal consulting firm suspects that an employee used a USB storage device to exfiltrate confidential client data. The employee had physical access to critical systems during off-hours. To proceed with the investigation, the team needs to confirm which USB device was connected and gather related evidence such as timestamps and device identifiers. Which method is most effective for detecting and verifying the specific USB device used in this insider incident?

Ethan, an incident handler, reviews traffic logs showing abnormal connections from internal devices to high-risk external domains. He traces these back to a misconfigured IoT device using outdated firmware. What kind of indicator was key in identifying the issue?

Which stage of the incident response and handling process involves auditing the system and network log files?

Tyler, a system administrator, notices high CPU usage and unknown processes on a workstation used to download unauthorized applications. Which indicator best describes this inappropriate usage incident?

Which of the following is not a best practice to eliminate the possibility of insider attacks?

Identify the network security incident where intended or authorized users are prevented from using system, network, or applications by flooding the network with a

high volume of traffic that consumes all existing network resources.

John is performing memory dump analysis in order to find out the traces of malware.

He has employed volatility tool in order to achieve his objective.

Which of the following volatility framework commands he will use in order to analyze running process from the memory dump?

Employee monitoring tools are mostly used by employers to find which of the following?

A ransomware attack recently disrupted operations at a manufacturing facility, specifically targeting its IoT-integrated conveyor system. While attempting to recover from the incident, the incident response team discovered that the available backups were incomplete—several critical sensor logs and control commands were missing, which caused delays in restoring device functions and syncing with other systems. The team concludes that relying on traditional backup routines alone is insufficient for restoring full IoT functionality after an attack. Which strategy would best prevent such issues in future recovery efforts?

Which of the following risk mitigation strategies involves execution of controls to

reduce the risk factor and brings it to an acceptable level or accepts the potential risk

and continues operating the IT system?

After a recent upgrade, users of TrendSpot, a popular blogging platform, started encountering slow website load times. Upon analysis, it was found that attackers were exploiting a vulnerability and flooding the application with fake search requests, causing an application-layer Denial-of-Service (DoS) attack. How should TrendSpot primarily respond to this attack?

OmegaTech Corp identified unauthorized remote access to its primary server and data exfiltration tunnels. Simultaneously, IoT device firmware corruption was reported. As the first responder, what should Olivia prioritize?

Post an upgrade in their global communication systems, NewsNet Corp., a media conglomerate, experienced anomalies. Subsequent analysis revealed malware that subtly altered news content, skewing information. Having an AI-based content checker and a network segregation tool, what ' s the immediate approach?

Which of the following terms refers to the personnel that the incident handling and response (IH & R) team must contact to report the incident and obtain the necessary permissions?

Following a security alert, the incident response team at a legal consulting firm suspects that an employee used a USB storage device to exfiltrate confidential client data. To confirm which USB device was connected and gather timestamps and identifiers, which method is most effective?

Which of the following is a common tool used to help detect malicious internal or compromised actors?

Which of the following options describes common characteristics of phishing emails?

Which of the following terms refers to an organization’s ability to make optimal use of digital evidence in a limited period of time and with minimal investigation costs?

A multinational consultancy firm recently conducted a mobile security awareness session after noticing repeated incidents of suspicious activity on corporate-linked Android devices. During the session, IT discovered that several employees had been sideloading APK files from unofficial third-party websites to access premium apps for free. These unauthorized installations introduced malware that compromised login credentials, triggered unauthorized data exfiltration, and bypassed existing security filters. Further investigation revealed that the company lacked enforcement of application certification checks on enrolled Android devices, and employees were unaware of the risks of using unverified sources. What security control should be prioritized to prevent such behavior in the future?

Farheen is an incident responder at reputed IT Firm based in Florida. Farheen was asked to investigate a recent cybercrime faced by the organization. As part of this process, she collected static data from a victim system. She used DD tool command to perform forensic duplication to obtain an NTFS image of the original disk. She created a sector-by-sector mirror imaging of the disk and saved the output image file as image.dd.

Identify the static data collection process step performed by Farheen while collecting static data.

After a recent upgrade, users of Trend Spot encountered slow website load times. Analysis revealed attackers flooding the application with fake search requests, causing an application-layer DoS attack. How should Trend Spot primarily respond?

Tara, a certified first responder in a digital forensics team, is dispatched to investigate a suspected insider attack targeting a critical workstation in the finance department. Upon arriving at the scene, she takes a methodical approach: she begins labeling all connected network cables, photographs the back panel of the workstation, documents cable connections, and records the power status of each connected device, including peripherals like external drives and monitors. She also notes the orientation and placement of equipment on the desk and the surrounding environment.

These actions are part of her protocol to ensure that, if the devices need to be moved for forensic analysis, investigators can accurately replicate the system ' s physical setup at the time of the incident. What is Tara aiming to achieve with these actions?

BadGuy Bob hid files in the slack space, changed the file headers, hid suspicious files in executables, and changed the metadata for all types of files on his hacker laptop. What has he committed?

Daniel, a SOC analyst, detects multiple incoming TCP requests to the organization ' s mail server from different IP addresses. However, none of the requests complete the handshake. He suspects a potential attempt to exhaust server resources and confirms this with netstat logs. Which type of protocol-level incident is Daniel identifying?

Bran is an incident handler who is assessing the network of the organization. In the

process, he wants to detect ping sweep attempts on the network using Wireshark tool.

Which of the following Wireshark filter he must use to accomplish this task?

Racheal is an incident handler working in InceptionTech organization. Recently,

numerous employees are complaining about receiving emails from unknown senders. In

order to prevent employees against spoofing emails and keeping security in mind,

Racheal was asked to take appropriate actions in this matter. As a part of her

assignment, she needs to analyze the email headers to check the authenticity of received

emails.

Which of the following protocol/authentication standards she must check in email

header to analyze the email authenticity?

A company utilizing multiple cloud services aims to enhance its posture against cloud security incidents. Among the following options, which constitutes the best practice for achieving this goal?

A cybersecurity analyst at a technology firm discovers suspicious activity on a network segment dedicated to research and development. The initial indicators suggest a possible compromise of several endpoints with potential intellectual property theft. Given the sensitive nature of the data involved, what is the most effective method for the analyst to detect and validate the security incident?

An organization ' s customers are experiencing either slower network communication or unavailability of services. In addition, network administrators are receiving alerts from security tools such as IDS/IPS and firewalls about a possible DoS/DDoS attack. In result, the organization requests the incident handling and response (IH & R) team further investigates the incident. The IH & R team decides to use manual techniques to detect DoS/DDoS attack.

Which of the following commands helps the IH & R team to manually detect DoS/DDoS attack?

An IT security analyst at a logistics firm is alerted to unusual outbound traffic originating from an employee’s mobile device connected to the corporate VPN. Antivirus scans fail to remove the malware, indicating persistence. The organization cannot afford further data leakage. Which action should the incident handler take next?

SafeGuard Inc., a cloud storage company, identified that attackers are exploiting a Server-Side Request Forgery (SSRF) vulnerability in their application, leading to internal network reconnaissance. To mitigate this vulnerability, which measure should SafeGuard Inc. prioritize?

James is working as an incident responder at CyberSol Inc. The management instructed James to investigate a cybersecurity incident that recently happened in the company. As a part of the investigation process, James started collecting volatile information from a system running on Windows operating system.

Which of the following commands helps James in determining all the executable files for running processes?

Jacob is an employee at a firm called Dolphin Investment. While he was on duty, he identified that his computer was facing some problems, and he wanted to convey the issue to the concerned authority in his organization. However, this organization currently does not have a ticketing system to address such types of issues. In the above scenario, which of the following ticketing systems can be employed by Dolphin Investment to allow Jacob to inform the concerned team about the incident?

Eric works as an incident handler at Erinol software systems. He was assigned a task to protect the organization from any kind of DoS/DDoS attacks.

Which of the following tools can be used by Eric to achieve his objective?

Mei, a forensic analyst, is analyzing logs from a compromised blog platform. She finds evidence that an attacker posted content using a valid account, and later, users who visited the blog were redirected to a phishing site containing session cookies in the URL. What kind of attack does this best describe?

DeltaCorp, a global e-commerce company, received an email sent to the financial department claiming to be from the CEO, requesting an urgent transfer of funds. To determine the legitimacy of this potentially deceptive email, which of the following should be the primary focus of the investigation?

In which of the following types of insider threats an insider who is uneducated on

potential security threats or simply bypasses general security procedures to meet

workplace efficiency?

NeuroNet, a pioneer in neural network research, was alarmed when it identified an insider siphoning off critical research data. Post-investigation, it was determined that the employee was disgruntled because of recent management decisions. To minimize such threats in the future, which measure should NeuroNet prioritize?

A large multinational enterprise recently integrated a digital HR onboarding system to streamline applicant submissions and document collection. During a cybersecurity audit, it was revealed that attackers had set up a phishing site mimicking the official HR document submission portal. Several employees and new hires uploaded their resumes and downloaded pre-filled form templates, believing them to be legitimate. Upon opening the downloaded Word documents, the system silently connected to external servers and fetched additional template data without any user consent or visible macro execution warnings. This bypassed email gateway filters and endpoint antivirus tools, leading to lateral malware spread across systems used by HR, finance, and legal departments.

Digital forensic analysis showed that the documents did not contain visible scripts or macros but relied on hidden structural definitions to retrieve malicious payloads dynamically from attacker-controlled servers. Which of the following web-based malware distribution techniques best explains the observed behavior?

Finn is working in the eradication phase, wherein he is eliminating the root cause of an incident that occurred in the Windows operating system installed in a system. He ran a tool that can detect missing security patches and install the latest patches on the system and networks. Which of the following tools did he use to detect the missing security patches?

Zoe, a security analyst, deploys a high-interaction honeypot in the DMZ that mimics critical systems and monitors logs for scans, exploit attempts, and lateral movement techniques. What is the main purpose of Zoe’s activity?