SY EX | PRAC 5 MASTER | notCOMPLETE

85問 • 5ヶ月前

問題一覧

While reviewing network flow logs, John sees that network flow on a particular segment suddenly dropped to zero. What is the most likely cause of this?

- A link failure

Saanvi is conducting the recovery process after his organization experienced a security incident. During that process, he plans to apply patches to all of the systems in his environment. Which one of the following should be his highest priority for patching?

- Systems involved in the incident

Susan's organization suffered from a major breach that was attributed to an advanced persistent threat (APT) that used exploits of zero-day vulnerabilities to gain control of systems on her company's network. Which of the following is the least appropriate solution for Susan to recommend to help prevent future attacks of this type?

- Signature-based attack detection methods

During his investigation of a Windows system, Eric discovered that files were deleted and he wants to determine whether a specific file previously existed on the computer. Which of the following is the least likely to be a potential location to discover evidence supporting that theory?

- Event logs

As part of her SOC analyst duties, Emily is tasked with monitoring intrusion detection systems that cover her employer's corporate headquarters network. During her shift, Emily's IDS alarms report that a network scan has occurred from a system with IP address 10.0.11.19 on the organization's WPA3 Enterprise wireless network aimed at systems in the finance division. What data source should she check first?

- Wireless authentication logs

Case's incident response process leads her to a production server that must stay online for her company's business to remain operational. What method should she use to the data she needs?

- Live image to an external drive.

What does the Nmap response "filtered" mean in port scan results?

- Nmap cannot tell whether the port is open or closed.

During her review of incident logs, Deep discovers the initial entry via SSH on a front-facing bastion host (A) at 8:02 a.m. If the network that Deepa is responsible for is designed as shown here, what is the most likely diagnosis if the second intrusion shows up on host B at 7:15 a.m.?

- Neither host B nor host A are synchronized to NTP properly.

Matt recently ran a vulnerability scan of his organization's network and received the results shown here. He would like to remediate the server with the highest number of the most serious vulnerabilities first. Which one of the following servers should be on his highest priority list?

- Server D

Saanvi has been tasked with conducting a risk assessment for the midsize bank that he works at because of a recent compromise of their online banking web application. Saanvi has chosen to use the NIST 800-30 risk assessment framework shown here. What likelihood of occurrence should he assign to breaches of the web application?

- High

Hank's boss recently came back from a CEO summit event where he learned about the importance of cybersecurit and the role of vulnerability scanning. He asked Hank about the vulnerability scans conducted by the organization and suggested that instead of running weekly scans that they simply configure the scanner to start a new scan immediately after the prior scan completes. How should Hank react to this request?

- Hank should consider the request and work with networking and engineering teams on possible implementation.

Selah's organization suffers an outage of its point-to-point encrypted VPN because of a system compromise at its ISP. What type of issue is this?

- Availability

Garrett is working with a database administrator to correct security issues on several servers managed by the database team. He would like to extract a report for the DBA that will provide useful information to assist in the remediation effort. Of the report templates shown here, which would be most useful to the DBA team?

- Technical Report

Jiang's SolarWinds network monitoring tools provide data about a system hosted in Amazon's AWS environment. When Jiang checks his server's average response time, he sees the results shown here. What action should Jiang take based on this information?

- He should perform additional diagnostics to determine the cause of the latency.

Alex notices the traffic shown here during a Wireshark packet capture. What is the host with IP address 10.0.2.11 most likely doing?

- SYN-based port scanning

Jake is building a forensic image of a compromised drive using the dd command with its default settings. He finds that the imaging is going very slowly. What parameter should he adiust first?

- bs

What purpose does a honeypot system serve when placed on a network as shown here?

- It provides information about the techniques attackers are using.

Munju's security team has found consistent evidence of system compromise over a period of weeks, with additional evidence pointing to the systems they are investigating being compromised for years. Despite her team's best efforts, Munju has found that her team cannot seem to track down and completely remove the compromise. What type of attack is Munju likely dealing with?

- An APT

Which one of the following metrics would be most useful in determining the effectiveness of a vulnerability remediation program?

- Time to resolve critical vulnerabilities

Mike's Nap scan of a system using the command map 192.168.1.100 does not return any results. What does Mike know about the system if he is sure of its IP address, and why?

- There are no TCP services reachable on Nap's default 1000 TCP ports.

What is the purpose of creating a hash value for a drive during the forensic imaging process?

- All of the above

After completing his unsuccessful forensic analysis of the hard drive from a workstation that was compromised by malware, Ben sends it to be re-imaged and patched by his company's desktop support team. Shortly after the system returns to service, the device once again connects to the same botnet. What action should Ben take as part of his next forensic review if this is the only system showing symptoms like this?

- Validate the BIOS hash against a known good version.

Part of the forensic data that Susan was provided for her investigation was a Wireshark packet capture. The investigation is aimed at determining what type of media an employee was consuming during work. What is the more detailed analysis that Susan can do if she is provided with the data shown here?

- She can export and view the GIF.

Which one of the following models traces the steps that an attacker would commonly perform during an intrusion?

- Cyber Kill Chain

Mika wants to run an Nmap scan that includes all TCP ports and uses service detection. Which of the following map commands should she execute?

- nmap -p 1-65535 -sV -sS

Which one of the following cloud service models relies on the cloud service provider to implement the greatest number of security controls?

- Saas

Dan is a cybersecurity analyst for a healthcare organization. He ran a vulnerability scan of the VPN server used by his organization. His scan ran from inside the datacenter against a VPN server also located in the datacenter. The complete vulnerability report is shown here. What action should Dan take next?

- Dan should take no action.

Kwame received an alert from his organization's SIEM that it detected a potential attack against a web server on his network. However, he is unsure whether the traffic generating the alert actually entered the network from an external source or whether it came from inside the network. The NAT policy at the network perimeter firewall rewrites public IP addresses, making it difficult to assess this information based on IP addresses. Kwame would like to perform a manual log review to locate the source of the traffic. Where should he turn for the best information?

- Firewall logs

Which one of the following types of vulnerability scans would provide the least information about the security configuration of a system?

- Uncredentialed external scan

After finishing a forensic case, Sam needs to wipe a magnetic hard drive HDD that he is using to prepare it for the next case. Which of the following methods is best suited to preparing the hard drive that he will use if he wants to be in compliance with NIST SP 800-88?

- Zero-write the drive.

After reading the NIST standards for incident response, Mateo spends time configuring the NTP service on each of his servers, workstations, and appliances throughout his network. What phase of the incident response process is he working to improve?

- Detection and analysis

Latisha is the ISO for her company and is notified that a zero-day exploit has been released that can result in remote code execution on all Windows workstations on her network because of an attack against Windows domain services. She wants to limit her exposure to this exploit but needs the systems to continue to be able to access the Internet. Which of the following approaches is best for her response?

- Firewalling

When Saanvi was called in to help with an incident recovery effort, he discovered that the network administrator had configured the network as shown here. What type of incident response action best describes what Saanvi has encountered?

- Isolation

As part of the forensic investigation of a Linux workstation, Alex needs to determine what commands may have been issued on the system. If no anti-forensic activities have taken place, what is the best location for Alex to check for a history of commands issued on the system?

- $HOME/.bash history

Ben recently completed a risk analysis and determined that he should implement a new set of firewall rules to filter traffic from known suspect IP addresses. What type of risk management activity is he performing?

- Risk mitigation

Crystal is attempting to determine the next task that she should take on from a list of security priorities. Her boss told her that she should focus on activities that have the most "bang for the buck." Of the tasks shown here, which should she tackle first?

- Task 3

During the analysis of an incident that took place on her network, Sofia discovered that the attacker used a stolen cookie to access a web application. Which one of the following attack types most likely occurred?

- Session hijacking

Curt is conducting a forensic analysis of a Windows system and needs to determine whether a program was set to automatically run. Which of the following locations should he check for this information?

- The registry

What concept measures how easy data is to lose?

- Order of volatility

Steps like those listed here are an example of what type of incident response preparation? 1. Visit ox.alienvault.com and the suspected C&C system's IP address on the top search input field. 2. If the IP address is associated with malware C&C activity, create a ticket in the incident response tracking system.

- Creating a playbook

While analyzing the vulnerability scan from her web server, Kristen discovers the issue shown here. Which one of the following solutions would best remedy the situation?

- Move from TLS 1.0 to TLS 1.3.

Charles is building an incident response playbook for his organization that will address command-and-control client-server traffic detection and response. Which of the following information sources is least likely to be part of his playbook?

- Honeypot data

Carol recently fell victim to a phishing attack. When she clicked the link in an email message that she received, she was sent to her organization's central authentication service and logged in successfully. She did verify the URL and certificate to validate that the authentication server was genuine. After authenticating, she was sent to a form that collected sensitive personal information that was sent to an attacker. What type of vulnerability did the attacker most likely exploit?

- Open redirect

As a penetration tester, Max uses Wireshark to capture all of his testing traffic. Which of the following is not a reason that Max would capture packets during penetration tests?

- To scan for vulnerabilities

Rich recently configured new vulnerability scans for his organization's business intelligence systems. The scans run late at night when users are not present. Rich received complaints from the business intelligence team that the performance burden imposed by the scanning is causing their overnight ETL jobs to run too slowly and they are not completing before business hours. How should Rich handle this situation?

- Rich should work with the team to find a mutually acceptable solution.

Javier ran a vulnerability scan of a new web application created by developers on his team and received the report shown here. The developers inspected their code carefully and do not believe that the issue exists. They do have a strong understanding of SQL injection issues and have corrected similar vulnerabilities in other applications. What is the most likely scenario in this case?

- The result is a false positive.

During an incident investigation, Mateo is able to identify the IP address of the system that was used to compromise multiple systems belonging to his company. What can Mateo determine from this information?

- None of the above

After a major compromise involving what appears to be an APT, Jaime needs to conduct a forensic examination of the compromised systems. Which containment method should he recommend to ensure that he can fully investigate the systems that were involved while minimizing the risk to his organization's other production systems?

- Removal

Piper is attempting to remediate a security vulnerability and must apply a patch to a production database server. The database administration team is concerned that the patch will disrupt business operations. How should Piper proceed?

- She should deploy the patch in a sandbox environment to test it prior to applying it in production.

Kent ran a vulnerability scan of an internal CRM server that is routinely used by employees, and the scan reported that no services were accessible on the server. Employees continued to use the CRM application over the Web without difficulty during the scan. What is the most likely source of Kent's result?

- The scan was run from a different network perspective than user traffic.

Steve needs to perform an Nmap scan of a remote network and wants to be as stealthy as possible. Which of the following map commands will provide the stealthiest approach to his scan?

- map -PO -sS -TO 10.0.10.0/24

After performing threat hunting, Lakshman determines that it would be appropriate to disable some services on his organization's database servers. What activity is Lakshman engaging in?

- Reducing the attack surface

Jenna is configuring the scanning frequency for her organization's vulnerability scanning program. Which one of the following is the least important criteria for Jenna to consider?

- Operating system installed on systems

Donna is interpreting a vulnerability scan from her organization's network, shown here. She would like to determine which vulnerability to remediate first. Donna would like to focus on the most critical vulnerability according to the potential impact if exploited. Assuming the firewall is properly configured, which one of the following vulnerabilities should Donna give the highest priority?

- Severity 5 vulnerability in the file server

Which one of the following document categories provides the highest-level authority for an organization's cybersecurity program?

- Policy

Mateo is planning a vulnerability scanning program for his organization and is scheduling weekly scans of all the servers in his environment. He was approached by a group of system administrators who asked that they be given direct access to the scan reports without going through the security team. How should Mateo respond?

- Mateo should provide the administrators with access.

While reviewing a report from a vulnerability scan of a web server, Paul encountered the vulnerability shown here. What is the easiest way for Paul to correct this vulnerability with minimal impact on the business?

- Adjust directory permissions.

A log showing a successful user authentication is classified as what type of occurrence in NIST's definitions?

- An event

Fran is trying to run a vulnerability scan of a web server from an external network, and the scanner is reporting that there are no services running on the web server. She verified the scan configuration and attempted to access the website running on that server using a web browser on a computer located on the same external network and experienced no difficulty. What is the most likely issue with the scan?

- An intrusion prevention system is blocking access to the server.

During a regulatory compliance assessment, Manish discovers that his organization has implemented a multifactor authentication requirement for systems that store and handle highly sensitive data. The system requires that users provide both a password and a four-digit PIN. What should Manish note in his findings about this system?

- The factors used are both the same type of factor, making the control less effective.

Which one of the following mechanisms may be used to enhance security in a context-based authentication system?

- All of the above

Latisha's organization has faced a significant increase in successful phishing attacks, resulting in compromised accounts. She knows that she needs to implement additional technical controls to prevent successful attacks. Which of the following controls will be the most effective while remaining relatively simple and inexpensive to deploy?

- Application or token-based multifactor authentication

Lauren downloads a new security tool and checks its MD5. What does she know about the software she downloaded if she receives the following message? root@demo:-# md5sum -c demo.md5 demo.txt: FAILED md5sum: WARNING: 1 computed checksum did not match

- The files do not match.

Peter works for an organization that is joining a consortium of similar organizations that use a federated identity management (FIM) system. He is configuring his identity management system to participate in the federation. Specifically, he wants to ensure that users at his organization will be able to use their credentials to access federated services. What role is Peter configuring?

- Identity provider

Mika uses a security token like the unit shown here and a password to authenticate to her PayPal account. What two types of factors is she using?

- Something she knows and something she has.

During the account setup for her bank, Deep is asked to answer a series of questions about her past home addresses, financial transactions, and her credit history. What type of authentication factor is Deep being asked for?

- Knowledge factor

Charles is worried about users conducting SQL injection attacks. Which of the following solutions will best address his concerns?

- Performing user input validation

Which of the following risks is most commonly associated with vulnerability scanning activities?

- Services may be crashed by the scanner

Adam finds entries in his authentication logs for many of the systems in his network that all have logins for the same userlD with a variety of passwords. What type of attack has he discovered?

- A password spraying attack

You are reviewing the methods that your organization uses to communicate with the media during an incident response effort. Which one of the following is not a commonly accepted practice?

- Inform the media immediately of developments in the investigation.

Charles reviews the source code for a web application for vulnerabilities. What type of software assessment is this?

- Static analvsis

Isaac sees the following entry in his web logs. What type of attack has been attempted? http://example.com/../. ./../../etc/shadow

- A directory traversal attack

Precompiled SQL statements that only require variables to be input are an example of what type of application security control?

- Parameterized queries

Rob would like to perform a root-cause analysis in the wake of an incident. He will be including the results of that analysis in his incident report. What action should he take first?

- Identify the problems and events that occurred.

What are activities like disabling unnecessary processes, moving systems to internal IP addresses, and using firewalls and other network security devices to protect hosts known as in the context of threat hunting?

- Reducing the attack surface areas

Bob is creating a report to management summarizing the result of a recent vulnerability scan. He would like to prioritize the results. Which one of the following tools would provide the most comprehensive assessment of the risk posed by each vulnerability?

- CVSS score

Kelly's organization recently suffered a security incident where the attacker was present on her network for several months before the SOC identified the attack. Once they saw evidence, they quickly reacted to contain the incident. Which incident response metric would suffer most as a result of this performance?

- Mean time to detect

Seth is trying to identify activities in his organization that might be automated to improve efficiency. Which one of the following activities is least likely to benefit from automation?

- Qualitative risk assessment

Rae wants to detect forged sender addresses to decrease the amount of spam that her organization receives. Which of the following techniques or methods will most directly fit her needs?

- DKIM

Your organization recently suffered a series of serious vulnerabilities as a result of the use of legacy software that is no longer supported by the vendor. This software is critical to your organization and can't be removed for at least six more months. What action plan would best address this risk during that six month period?

- Compensating controls

Yolanda received a threat intelligence report and is evaluating it to determine whether her organization runs any of the software affected by the threat. What type of confidence is Yolanda attempting to gain?

- Relevancy

Gabby's organization captures sensitive customer information, and salespeople and others often work with that data on local workstations and laptops. After a recent inadvertent breach where a salesperson accidentally sent a spreadsheet of customer information to another customer, her organization is seeking a technology solution that can help prevent similar problems. What should Gabby recommend?

- DLP

Fred is reviewing a checklist used in the automation of his security program and sees the following code: What file type from the following list is he most likely reviewing?

- XML

Cynthia's organization receives a letter from a company they are a service provider for, notifying them of a pending legal case and telling them not to delete or discard documents related to the case. What term describes this?

- Legal hold

As part of his forensic investigation, Alex signs and notes in his log when the drive copy he prepared is transferred to legal counsel. What is this process known as?

- Chain of custody tracking

THE P.T: 1 CHRONICLE: ( ex.9 )

The R.S.S.H Delivery Company · 90問 · 6ヶ月前

THE P.T: 1 CHRONICLE: ( ex.9 )