SecurityX (CASP+) Practice Exam

The answer is B, The specific custom-developed polymorphic packer used to obfuscate the ransomware payload..

Correct: Capability in the Diamond Model refers to the tools, techniques, and skills used by the adversary (e.g., malware, exploits). Wrong A: This is Infrastructure. Wrong C: This is the Adversary node. Wrong D: This is related to the Victim or the exploit phase, but the credentials themselves are not the 'capability' of the attacker in the context of their toolkit.

The answer is A, Implementing a Common Information Model (CIM) to normalize disparate log formats from both environments..

Correct: Normalizing logs into a Common Information Model (CIM) allows the SIEM to correlate events (e.g., matching a source IP in a cloud log to an account in an on-prem log) regardless of original format. Wrong B: Retention is for compliance, not correlation effectiveness. Wrong C: Pulling logs should follow the principle of least privilege, not use a high-level admin account. Wrong D: Separate SIEMs prevent effective automated cross-environment correlation.

The answer is C, The confirmed compromise of a system within the defined 'Critical' data zone..

Correct: Escalation to executive leadership should be reserved for high-impact events, such as the compromise of systems containing critical or sensitive data (e.g., intellectual property or PII). Wrong A: Perimeter attempts are common and handled by automated systems. Wrong B: This is an operational issue with no immediate service impact due to redundancy. Wrong D: This is a routine SOC task and does not warrant executive escalation unless it spreads or targets critical systems.

The answer is D, Chaos engineering.

Correct: Chaos engineering involves purposefully introducing failure or stress (like latency) to verify the system's ability to handle it. Wrong A: Penetration testing looks for vulnerabilities. Wrong B: Fuzzing tests input validation. Wrong C: Regression testing ensures new code doesn't break existing functionality.

The answer is C, A malware beaconing signal designed to bypass detection by introducing variability in the timing..

Correct: Beaconing is a common C2 (Command and Control) technique. Jitter is specifically used to evade detection by making the heartbeat less predictable. Wrong A: Legitimate updates usually don't use jitter to hide. Wrong B: Exfiltration is typically larger in volume; beacons are small signals. Wrong D: Health checks are usually much more frequent and lack jitter.

The answer is C, Using MDM to push a certificate-based Wi-Fi profile and disabling 'Auto-Join' for unknown networks.

Correct: Pushing a specific, secure Wi-Fi profile (using 802.1X) and restricting the device's ability to join unmanaged or open networks is the most effective way to prevent rogue AP connections. Wrong A: Prompting doesn't stop a user from making a bad choice. Wrong B: This is an administrative control and is difficult to maintain. Wrong D: Hardware tokens are for authentication but don't prevent the device from connecting to a rogue AP in the first place.

The answer is B, Inadequate performance or usability of the sanctioned internal file transfer solutions..

Correct: Shadow IT is almost always driven by business needs (efficiency, usability, or features) that are not being met by the current IT/Security sanctioned tools. Wrong A: While least privilege is a security goal, it is rarely the primary driver for users seeking outside tools unless the restriction prevents work entirely. Wrong C: CSR focuses on ethics and social impact, not IT service usability. Wrong D: While R&D growth increases the volume of work, it doesn't directly cause Shadow IT unless the tools are lacking.

The answer is D, RAID 10.

Correct: RAID 10 (1+0) combines mirroring and striping, providing high performance and high redundancy. Wrong A: RAID 0 has no redundancy. Wrong B: RAID 5 has a write penalty due to parity. Wrong C: RAID 6 has a higher write penalty than RAID 5.

The answer is C, File a Form 8-K with the SEC within four business days of determining the incident is material..

Correct: The SEC requires public companies to disclose material cybersecurity incidents on Form 8-K within four business days of the materiality determination. Wrong A, B, D: These do not reflect the specific SEC mandate for material incident reporting.