A company help desk is flooded with calls regarding systems experiencing slow performance and certain Internet sites taking a long time to load or not loading at all. The security operations center (SOC) analysts who receive these calls take the following actions:
-Running antivirus scans on the affected user machines
-Checking department membership of affected users
-Checking the host-based intrusion prevention system (HIPS) console for affected user machine alerts
-Checking network monitoring tools for anomalous activities
Which of the following phases of the incident response process match the actions taken?
Which of the following data sources could provide indication of a system compromise involving the exfiltration of data to an unauthorized destination?
During a security investigation, a suspicious Linux laptop is found in the server room. The laptop is processing information and indicating network activity. The investigator is preparing to launch an investigation to
determine what is happening with this laptop. Which of the following is the MOST appropriate set of Linux commands that should be executed to conduct the investigation?
A company is reviewing the results of the Nikto scan, and they determined that several internal web servers (likely associated with internal web applications) have a number of vulnerabilities. They also noticed several servers that have returned click-jacking vulnerabilities. Which option should be used to remediate this issue?
A web server is under a denial of service (DoS) attack. The administrator reviews logs and creates an access control list (ACL) to stop the attack. Which of the following technologies could perform these steps automatically in the future?
A security engineer is setting up security information and event management (SIEM). Which of the following log sources should the engineer include that will contain indicators of a possible web server compromise? (Choose two.)
A computer forensics analyst suspects that some of the pictures recovered from the suspect's hard drive may contain metadata pertinent to the criminal investigation. Which of the following tools is BEST suited to retrieving any available metadata?
Which three answer options are password attack methods and techniques? (Choose three.)
What are three benefits of security logging and monitoring? (Choos)
After successfully enumerating the target, the hacker determines that the victim is using a firewall. Which of the following techniques would allow the hacker to bypass the intrusion prevention system (IPS)?
A common formula used to calculate risk is:+ Threats + Vulnerabilities = Risk. Which of the following represents the missing factor in this formula?
During recovery from an incident, which three options should a company focus on? (Choose three.)
A first responder notices a file with a large amount of clipboard information stored in it. Which part of the MITRE ATT&CK matrix has the responder discovered?
Which of the following are well-known methods that are used to protect evidence during the forensics process? (Choose three.)
An unauthorized network scan may be detected by parsing network sniffer data for:
Tcpdump is a tool that can be used to detect which of the following indicators of compromise?
What term means that data is valid and not corrupt?
During which phase of the incident response process should an organization develop policies and procedures for incident handling?
In a Linux operating system, what kind of information does a /var/log/daemon.log file contain?
During an incident, the following actions have been taken:
-Executing the malware in a sandbox environment
-Reverse engineering the malware
-Conducting a behavior analysis
Based on the steps presented, which of the following incident handling processes has been taken?
Malicious code designed to execute in concurrence with a particular event is BEST defined as which of the following?
Which of the following is BEST suited to prevent piggybacking into a sensitive or otherwise restricted area of a facility?
If an organization suspects criminal activity during the response to an incident, when should they notify law enforcement authorities?
Which of the following is the GREATEST risk of having security information and event management (SIEM) collect computer names with older log entries?
Which three of the following are included in encryption architecture? (Choose three.)
Which of the following are legally compliant forensics applications that will detect an alternative data stream (ADS) or a file with an incorrect file extension? (Choose two.)
A security analyst needs to capture network traffic from a compromised Mac host. They attempt to execute the tcpdump command using their general user account but continually receive an "Operation Not Permitted" error.
Use of which of the following commands will allow the analyst to capture traffic using tcpdump successfully?
Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)
Which of the following tools can be used as an intrusion detection system (IDS)? (Choose three.)
If a hacker is attempting to alter or delete system audit logs, in which of the following attack phases is the hacker involved?
Which of the following sources is best suited for monitoring threats and vulnerabilities?
What is the definition of a security breach?
Which of the following attack vectors capitalizes on a previously undisclosed issue with a software application?
Traditional SIEM systems provide:
Which of the following is susceptible to a cache poisoning attack?
What are three examples of incident response? (Choose three.)
Which of the following tools can help to detect suspicious or unauthorized changes to critical system configuration files?
Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?
Which answer option is a tactic of social engineering in which an attacker engages in an attack performed by phone?
An incident at a government agency has occurred and the following actions were taken:
-Users have regained access to email accounts
-Temporary VPN services have been removed
-Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated
-Temporary email servers have been decommissioned
Which of the following phases of the incident response process match the actions taken?
Which of the following types of attackers would be MOST likely to use multiple zero-day exploits executed against high-value, well-defended targets for the purposes of espionage and sabotage?
Which two options represent the most basic methods for designing a DMZ network firewall? (Choose two.)
How does encryption work to protect information on remote workers' computers?
Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are
MOST important for log integrity? (Choose two.)
An automatic vulnerability scan has been performed. Which is the next step of the vulnerability assessment process?
A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank’s website and asks them to log in with their username and password. Which type of attack is this?
An incident response team is concerned with verifying the integrity of security information and event
management (SIEM) events after being written to disk. Which of the following represents the BEST option for addressing this concern?
Which are successful Disaster Recovery Plan best practices options to be considered? (Choose three.)
A security administrator notices a process running on their local workstation called SvrsScEsdKexzCv.exe.
The unknown process is MOST likely:
What is baseline security?
Detailed step-by-step instructions to follow during a security incident are considered:
What are the two most appropriate binary analysis techniques to use in digital forensics analysis? (Choose two.)
In which of the following attack phases would an attacker use Shodan?
Which of the following is a cybersecurity solution for insider threats to strengthen information protection?