CYSA 361-580 Exam Questions and Answers
with Verified Solutions | Latest Updated 2026
SIMULATION High CPU Utilization, wuauclt.exe
Welcome to the Enterprise Help
Desk System. Please work the
ticket
escalated to you in the help desk
ticket queue.
INSTRUCTIONS
Click on the ticket to see the ticket
details. Additional content is
available on tabs within the ticket.
First, select the appropriate issue
from the drop-down menu. Then,
select the MOST likely root cause
from the second drop-down menu.
If at any time you would like to
bring
back the initial state of the
simulation, please click the Reset
All
button.
,SIMULATION Kill Chain Item:
A company recently experienced a Phishing email - Email filtering
security incident, The security Active links - VPN
team Malicious website access - IP blocklist
has determined a user clicked on Malware download - Firewall file type filter
a Malware install - Restricted local user
link embedded in a phishing email permissions
that was sent to the entire Malware Executions - Updated antivirus
company. File Encryption - Backups
The link resulted in a malware Identify the following:
download, which was Malicious executable - Payroll/xlsx
subsequently Malicious IP Address - 81.161.63.103
installed and run. Date/Time malware entered organization -
INSTRUCTIONS 1 Dec
Part 1 2019 14:03:19
Review the artifacts associated
with
the security incident. Identify the
name of the malware, the
malicious
IP address, and the date and time
when the malware executable
entered the organization
Part 2
Review the kill chain items and
select
an appropriate control for each
that
would improve the security posture
of the organization and would
have
helped to prevent this incident
from
occurring. Each control may only
be
used once, and not all controls will
,be used.
If at any time you would like to
bring
back the initial state of the
simulation, please click the Reset
ALL
button.
An analyst reviews a recent E:U
government alert on new zero-day
threats and finds the following
CVE
metrics for the most critical of the
vulnerabilities:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S
:C/
C:H/I:H/A:H/E:U/RL:W/RC:R
Which of the following represents
the exploit code maturity of this
critical vulnerability?
A. E:U
B. S:C
C. RC:R
D. AV:N
E. AC:L
, A security analyst detects an email Containment
server that had been compromised
in the internal network. Users have
been reporting strange messages
in
their email inboxes and unusual
network traffic. Which of the
following incident response steps
should be performed next?
A. Preparation
B, Validation
C. Containment
D. Eradication
A SIEM alert is triggered based on Attacker is executing PowerShell script
execution of a suspicious one-liner "AccessToken.ps1"
on two workstations in the
organization's environment. An
analyst views the details of these
events below:
Which of the following statements
best describes the intent of the
attacker, based on this one-liner?
A. Attacker is escalating privileges
via JavaScript
B. Attacker is utilizing custom
malware to download an additional
script
C. Attacker is executing
PowerShell
script "AccessToken.ps1"
D. Attacker is attempting to install
persistence mechanisms on the
target machine
with Verified Solutions | Latest Updated 2026
SIMULATION High CPU Utilization, wuauclt.exe
Welcome to the Enterprise Help
Desk System. Please work the
ticket
escalated to you in the help desk
ticket queue.
INSTRUCTIONS
Click on the ticket to see the ticket
details. Additional content is
available on tabs within the ticket.
First, select the appropriate issue
from the drop-down menu. Then,
select the MOST likely root cause
from the second drop-down menu.
If at any time you would like to
bring
back the initial state of the
simulation, please click the Reset
All
button.
,SIMULATION Kill Chain Item:
A company recently experienced a Phishing email - Email filtering
security incident, The security Active links - VPN
team Malicious website access - IP blocklist
has determined a user clicked on Malware download - Firewall file type filter
a Malware install - Restricted local user
link embedded in a phishing email permissions
that was sent to the entire Malware Executions - Updated antivirus
company. File Encryption - Backups
The link resulted in a malware Identify the following:
download, which was Malicious executable - Payroll/xlsx
subsequently Malicious IP Address - 81.161.63.103
installed and run. Date/Time malware entered organization -
INSTRUCTIONS 1 Dec
Part 1 2019 14:03:19
Review the artifacts associated
with
the security incident. Identify the
name of the malware, the
malicious
IP address, and the date and time
when the malware executable
entered the organization
Part 2
Review the kill chain items and
select
an appropriate control for each
that
would improve the security posture
of the organization and would
have
helped to prevent this incident
from
occurring. Each control may only
be
used once, and not all controls will
,be used.
If at any time you would like to
bring
back the initial state of the
simulation, please click the Reset
ALL
button.
An analyst reviews a recent E:U
government alert on new zero-day
threats and finds the following
CVE
metrics for the most critical of the
vulnerabilities:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S
:C/
C:H/I:H/A:H/E:U/RL:W/RC:R
Which of the following represents
the exploit code maturity of this
critical vulnerability?
A. E:U
B. S:C
C. RC:R
D. AV:N
E. AC:L
, A security analyst detects an email Containment
server that had been compromised
in the internal network. Users have
been reporting strange messages
in
their email inboxes and unusual
network traffic. Which of the
following incident response steps
should be performed next?
A. Preparation
B, Validation
C. Containment
D. Eradication
A SIEM alert is triggered based on Attacker is executing PowerShell script
execution of a suspicious one-liner "AccessToken.ps1"
on two workstations in the
organization's environment. An
analyst views the details of these
events below:
Which of the following statements
best describes the intent of the
attacker, based on this one-liner?
A. Attacker is escalating privileges
via JavaScript
B. Attacker is utilizing custom
malware to download an additional
script
C. Attacker is executing
PowerShell
script "AccessToken.ps1"
D. Attacker is attempting to install
persistence mechanisms on the
target machine
