Security Monitoring (25%): Log analysis and data interpretation, Distributed Denial of Service (DDoS) attacks, SQL injection attacks, Social engineering techniques, and Ransomware.

Host-based Analysis (20%): Host‑based security technologies, Intrusion prevention techniques, and Intrusion detection techniques.

Network Intrusion Analysis (20%): Network protocol analysis, Network intrusion detection, and Packet capture and analysis.

Security Policies & Procedures (15%): Security management concepts, Regulatory compliance (national/international), and Incident response best practices.

B. Targeted Ransomware deployment

C. Volumetric Distributed Denial of Service (DDoS)

D. Phishing via Social Engineering

E. Local Privilege Escalation

F. Cross-Site Scripting (XSS)

Correct Answer: C. Volumetric Distributed Denial of Service (DDoS)

Overall Explanation: The scenario describes a classic DDoS attack, specifically an application-layer volumetric attack. The key indicators are a massive number of requests (thousands), multiple global sources (distributed), and resource exhaustion (99% CPU) causing service denial.

Detailed Option Breakdown:

B is incorrect: Ransomware aims to encrypt files for financial gain. While it might cause high CPU usage during encryption, it does not typically present as a flood of incoming web requests from external IPs.

C is correct: A DDoS attack uses multiple distributed systems to flood a target with traffic, exhausting its resources (like CPU or bandwidth) and making it unavailable to legitimate users.

D is incorrect: Phishing and social engineering rely on human deception (e.g., deceptive emails) to steal credentials, not automated web traffic floods.

E is incorrect: Local Privilege Escalation involves a user who already has low-level system access exploiting a bug to gain admin rights. It does not match external distributed web traffic.

F is incorrect: Cross-Site Scripting involves injecting malicious scripts into webpages viewed by other users, which leaves a different log footprint entirely than a volumetric traffic flood.

B. Discretionary Access Control (DAC)

C. Role-Based Access Control (RBAC)

D. Attribute-Based Access Control (ABAC)

E. Rule-Based Access Control (RuBAC)

F. Identity-Based Access Control (IBAC)

Correct Answer: C. Role-Based Access Control (RBAC)

Overall Explanation: The administrator is assigning permissions based on the user's job function or department (HR, Finance) rather than their specific individual identity. This is the definition of Role-Based Access Control, which greatly simplifies administration in large organizations.

Detailed Option Breakdown:

B is incorrect: DAC allows the creator or owner of a file to grant access to others at their own discretion. The scenario describes an administrator centrally managing access via groups.

C is correct: RBAC assigns permissions to specific roles (like HR or Finance), and users are simply placed into those roles to inherit the necessary permissions.

D is incorrect: ABAC uses complex policies evaluating multiple attributes (time of day, location, device posture) rather than just a simple departmental role.

E is incorrect: Rule-Based Access Control relies on global rules applied to everyone (like firewall ACLs blocking a port), not functional business groups.

F is incorrect: Identity-Based Access Control focuses on assigning permissions directly to individual user identities, which the scenario explicitly states the administrator is avoiding.

B. Wireshark

C. Snort

D. Hashcat

E. Ping

F. Netstat

Correct Answer: B. Wireshark

Overall Explanation: Wireshark is a graphical network protocol analyzer that features a "Follow TCP/HTTP Stream" capability. This feature allows an analyst to easily view and extract (save) raw payloads, such as malware executables, directly from a packet capture (PCAP) file.

Detailed Option Breakdown:

B is correct: Wireshark allows deep packet inspection and provides built-in tools to reconstruct and extract files transferred over protocols like HTTP.

C is incorrect: Snort is an Intrusion Detection System (IDS). While it analyzes packets to generate alerts based on rules, it is not primarily used by an analyst to manually extract files from a PCAP.

D is incorrect: Hashcat is a password recovery and cracking tool, entirely unrelated to network traffic analysis.

E is incorrect: Ping is a basic command-line tool used to test network reachability via ICMP, not for analyzing packet captures.

F is incorrect: Netstat shows active local network connections on a host. It does not capture packets or extract payloads.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app