Free ASSA80 Practice Questions

Question 1

After a routing change, Security Analytics shows client SYNs, subsequent client ACKs, and HTTP requests, but no server packets for the same connections. Application logs confirm successful responses. The SPAN session mirrors both directions of the monitored link, and no capture or search filter excludes the replies. Which explanation fits this combination of findings?

Accepted Answer

The return traffic is taking a route that bypasses the monitored link.

Answer

The SPAN source is configured to copy ingress traffic but exclude egress traffic.

Answer

The server is rejecting TCP connections before processing the requests.

Answer

A capture filter is discarding the server replies before they reach packet storage.

Question 2

An analyst needs records from sensor Branch-2 with either of two destination IP addresses. The Boolean logic is written as:
(sensor = Branch-2 AND destination = 198.51.100.10) OR destination = 198.51.100.20
Records for 198.51.100.20 are appearing from other sensors. Which replacement preserves both destinations while restricting every result to Branch-2?

Accepted Answer

sensor = Branch-2 AND (destination = 198.51.100.10 OR destination = 198.51.100.20)

Answer

(sensor = Branch-2 OR destination = 198.51.100.10) AND destination = 198.51.100.20

Answer

sensor = Branch-2 AND (destination = 198.51.100.10 AND destination = 198.51.100.20)

Answer

sensor = Branch-2 OR (destination = 198.51.100.10 AND destination = 198.51.100.20)

Question 3

Security Analytics captures an ongoing transfer of payroll records from a workstation to an external server. The incident lead confirms that the transfer is unauthorized and approves endpoint isolation, which will block the workstation's network traffic without powering it off. The workstation has no safety-critical function. A complete packet export will take another 30 minutes. What should happen next?

Accepted Answer

Isolate the workstation now and preserve the captured evidence in parallel.

Answer

Keep the connection open until the packet export finishes, then isolate the workstation.

Answer

Stop capture on the sensor to interrupt the transfer.

Answer

Power off the workstation now, then acquire its disks before restoring any network access.

Question 4

A fully captured HTTP GET response contains these headers:
HTTP/1.1 206 Partial Content
Content-Range: bytes 4096-8191/32768
Content-Length: 4096
There is no content encoding or body transformation. Security Analytics recovers all 4,096 response-body bytes, but no other ranges are available. Their SHA-256 digest differs from the published digest of a complete 32,768-byte malicious file. What does this comparison establish?

Accepted Answer

A fragment's digest cannot rule out a match between the complete original file and the malicious sample.

Answer

The original file differs from the malicious sample because the recovered digest does not match its published digest.

Answer

The extraction is defective because a successfully transferred file must be returned with HTTP status 200.

Answer

The digest mismatch establishes that the client failed to complete the download of the original file.

Question 5

External sign-in to a Security Analytics deployment fails with a TLS certificate error: 'not yet valid.' Local sign-in works. The actual date is September 11, 2026. The identity service's certificate is valid from September 1, 2026, through August 31, 2027; its hostname and trust chain check out. The appliance console reports August 12, 2026. Which repair addresses the demonstrated cause?

Accepted Answer

Correct the appliance clock and restore synchronization with its NTP source.

Answer

Replace the identity service certificate with one issued for the appliance's hostname.

Answer

Reset the external users' passwords and resynchronize their directory group memberships.

Answer

Replace the CA certificate trusted for external authentication.

Question 6

A Security Analytics virtual appliance receives a physical-switch SPAN feed and captures Internet-bound traffic. Two application VMs on the same hypervisor exchange files entirely within a virtual switch, without using the physical uplink. The monitoring adapter already accepts delivered frames addressed to other MAC addresses. To observe this exchange without changing the applications' forwarding path, the administrator should:

Accepted Answer

Mirror the internal virtual-switch traffic to the appliance's assigned capture adapter.

Answer

Enable promiscuous reception on the physical uplink while keeping the existing SPAN source.

Answer

Mirror more physical switch ports without changing virtual traffic delivery.

Answer

Increase the virtual appliance's CPU allocation and rebuild its existing session indexes.

Question 7

A threat-intelligence notice identifies malware at https://updates.example.test/download/agent.exe. An IP-only indicator in Security Analytics also flags legitimate sites sharing that server address. An authorized decrypted feed exposes the hostname and full request path for the HTTPS requests. Which matching criterion stays closest to the specific evidence in the notice?

Accepted Answer

Require the hostname updates.example.test and the exact request path /download/agent.exe to match together.

Answer

Keep the IP match and quarantine every client that contacts that address.

Answer

Match any request for a file named agent.exe, regardless of its hostname or directory.

Answer

Match every request to updates.example.test, regardless of which resource on that host is requested.

Question 8

During a sustained replication job, a full-duplex link carries 700 Mb/s in one direction and 600 Mb/s in the other. SPAN copies both directions into a single 1 Gb/s monitor output feeding Security Analytics. Buffers cannot absorb sustained excess traffic. The sensor reports zero local packet drops. Which capacity assessment should govern the capture design?

Accepted Answer

1.3 Gb/s is offered; the mirror output cannot preserve every copied byte.

Answer

0.7 Gb/s is offered; investigate reconstruction rather than mirror-output capacity.

Answer

0.65 Gb/s is offered; averaging both directions leaves sufficient capacity.

Answer

1.0 Gb/s is offered; zero sensor drops confirm complete upstream capture.

Question 9

An intrusion timeline shows a malicious executable downloaded at 09:10 and an unauthorized startup entry created at 09:12. At 09:14, Security Analytics captures the host retrieving attacker-issued instructions and acknowledging receipt. No data theft or destructive operation has yet been observed. In the seven-stage Cyber Kill Chain, the 09:14 exchange specifically demonstrates which stage?

Accepted Answer

Command and Control

Answer

Delivery

Answer

Installation

Answer

Actions on Objectives

Question 10

HTTPS access to a Security Analytics appliance at 198.51.100.20 fails from an authorized Linux administration workstation. Another workstation on 192.0.2.0/24 can reach it. The affected workstation can reach router 192.0.2.1, which provides access to the appliance's subnet. The entire output of 'ip route show' is:
192.0.2.0/24 dev eth0 proto kernel scope link src 192.0.2.25
No policy routing is configured. Which correction addresses the fault shown?

Accepted Answer

Configure a route to 198.51.100.0/24 via 192.0.2.1 on the affected workstation.

Answer

Use the working workstation's DNS resolver for name lookups.

Answer

Add a return route for 192.0.2.0/24 through the appliance's management gateway.

Answer

Add the workstation's IP address to the appliance's list of permitted HTTPS clients.

Free ASSA80 Practice Questions

Domain 2: Describe the core architecture of Security Analytics, including virtual and hardware appliances

Question 1

Domain 3: Describe the Symantec Security Analytics network architecture requirements, including the differences between network TAPs and SPAN ports

Question 2

Question 3

Domain 4: Describe how to configure Security Analytics deployment, including key options within both the CLI and web interface

Question 4

Question 5

Domain 5: Describe how to perform basic and advanced filtering, create indicators, and apply recommended filtering best practices

Question 6

Question 7

Domain 6: Describe the file extraction process, the resulting artifacts, and the purposes they serve

Question 8

Domain 7: Describe the anatomy of a cyber-attack, the steps of the Cyber Kill Chain, and what makes up an Indicator of Compromise (IoC)

Question 9

Domain 8: Describe threat hunting and incident response frameworks and procedures

Question 10

The rest of the ASSA80 blueprint

That's 10 of 1,030