SY EX | 3 MASTER | 暗記メーカー

SY EX | 3 MASTER

150問 • 5ヶ月前

問題一覧

Consider the threat modeling analysis shown here. What attack framework was used to develop this analysis?

- Diamond

As part of an organization-wide red team exercise, Frank is able to use a known vulnerability to compromise an Apache web server. Frank knows that the Apache service is running under a limited user account. Once he has gained access, what should his next step be if he wants to use the system to pivot to protected systems behind the screened subnet (DMZ) that the web server resides in?

- Privilege escalation

Helen is using the Lockheed Martin Cyber Kill Chain to analyze an attack that took place against her organization. During the attack, the perpetrator attached a malicious tool to an email message that was sent to the victim. What phase of the Cyber Kill Chain includes this type of activity?

- Delivery

Betty wants to review the security logs on her Windows workstation. What tool should she use to do this?

- Event Viewer

The ATT&CK framework defines which of the following as "the specifics behind how the adversary would attack the target?"

- The attack vector

Jamal wants to leverage a framework to improve his threat hunting for network defense. What threat-hunting framework should he select to help his team categorize and analyze threats more effectively?

- MITRE ATT&CK

Maria is an Active Directory domain administrator for her company, and she knows that a quickly spreading botnet relies on a series of domain names for command and control and that preventing access to those domain names will cause the malware infection that connects to the botnet to fail to take further action. Which of the following actions is her best option if she wants to prevent offsite Windows users from connecting to botnet command-and-control systems?

- Modify the hosts file.

While attempting to stop a rogue service, Monica issues the following Linux command on an Ubuntu system using upstart: service rogueservice stop After a reboot, she discovers the service running again. What happened, and what does she need to do to prevent this?

- The service restarted at reboot, so she should add an override file to stop the service from starting.

Questions 9-12 refer to the following scenario and image. Bill is reviewing the authentication logs for a Linux system that he operates and encounters the following log entries: Aug 30 09:46:54 ip-172-30-0-62 sshd30511: Accepted publickey for ec2-user from 10.174.238.88 port 57478 ssh2: RSA e5:5:1:46:bb:49:a1:43:da:9d:50:05:37:bd:79:22 Aug 30 09:46:54 ip-172-30-0-62 ssh[3051]: pam unix[sshd:session]: session opened for user ec2-user by (uid=0) Aug 30 09:48:06 ip-172-30-0-62 sudo: ec2-user : TTY=pS/ 0 ; PWD=/home/ec2-user ; USER=root; COMMAND=/bin/bash 9. What is the IP address of the system where the user was logged in when they initiated the connection?

- 10.174.238.88

Questions 9-12 refer to the following scenario and image. Bill is reviewing the authentication logs for a Linux system that he operates and encounters the following log entries: Aug 30 09:46:54 ip-172-30-0-62 sshd30511: Accepted publickey for ec2-user from 10.174.238.88 port 57478 ssh2: RSA e5:5:1:46:bb:49:a1:43:da:9d:50:05:37:bd:79:22 Aug 30 09:46:54 ip-172-30-0-62 ssh[3051]: pam unix[sshd:session]: session opened for user ec2-user by (uid=0) Aug 30 09:48:06 ip-172-30-0-62 sudo: ec2-user : TTY=pS/ 0 ; PWD=/home/ec2-user ; USER=root; COMMAND=/bin/bash 10. What service did the user use to connect to the server?

- SSH

Questions 9-12 refer to the following scenario and image. Bill is reviewing the authentication logs for a Linux system that he operates and encounters the following log entries: Aug 30 09:46:54 ip-172-30-0-62 sshd30511: Accepted publickey for ec2-user from 10.174.238.88 port 57478 ssh2: RSA e5:5:1:46:bb:49:a1:43:da:9d:50:05:37:bd:79:22 Aug 30 09:46:54 ip-172-30-0-62 ssh[3051]: pam unix[sshd:session]: session opened for user ec2-user by (uid=0) Aug 30 09:48:06 ip-172-30-0-62 sudo: ec2-user : TTY=pS/ 0 ; PWD=/home/ec2-user ; USER=root; COMMAND=/bin/bash 11. What authentication technique did the user use to connect to the server?

- PKI

Questions 9-12 refer to the following scenario and image. Bill is reviewing the authentication logs for a Linux system that he operates and encounters the following log entries: Aug 30 09:46:54 ip-172-30-0-62 sshd30511: Accepted publickey for ec2-user from 10.174.238.88 port 57478 ssh2: RSA e5:5:1:46:bb:49:a1:43:da:9d:50:05:37:bd:79:22 Aug 30 09:46:54 ip-172-30-0-62 ssh[3051]: pam unix[sshd:session]: session opened for user ec2-user by (uid=0) Aug 30 09:48:06 ip-172-30-0-62 sudo: ec2-user : TTY=pS/ 0 ; PWD=/home/ec2-user ; USER=root; COMMAND=/bin/bash 12. What account did the individual use to connect to the server?

- ec2-user

Alaina adds the openphish URL list to her SOAR tool and sees the following entries: http://13.126.65.8/DocExaDemo/uploads/ index.php/bofa/bofa/95843de35406£3cab0b2dcf2b/ success.htm http://13.126.65.8/DocExaDemo/uploads/ index.php/bofa/bofa/9b094075409d3a723c7ee3d9e/ sitekey.php http://13.126.65.8/DocExaDemo/uploads/ index.php/bofa/bofa/9b094075409d3a723c7ee3d9e/ success.htm http://13.126.65.8/DocExaDemo/uploads/ index.php/bofa/bofa/9b094075409d3a723c7ee3d9e/ http://13.126.65.8/DocExaDemo/uploads / index.php/bofa/bofa/95843de35406f3cab0b2dcf2b/ http://13.126.65.8/DocExaDemo/uploads/ index.php/bofa/bofa/95843de35406f3cab0b2dcf2b/ sitekey.php What action should she take based on phishing URLs like these?

- Delete emails with the URL from inbound email.

Rowan wants to block drive-by-downloads and bot command-and-control channels while redirecting potentially impacted systems to a warning message. What should she implement to do this?

- A DNS sinkhole

- No impact to services

Use the following table and rating information for questions 15-17. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) uses a 1-100 scale for incident prioritization, with weight assigned to each of a number of categories. The functional impact score is weighted in their demonstration as follows: 16. Nathan's organization uses a software-as-a-service (SaaS) tool to manage their customer mailing lists, which they use to inform customers of upcoming sales a week in advance. The organization's primary line of business software continues to function and merchandise can be sold. Because of a service outage, they are unable to add new customers to the list for a full business day. How should Nathan rate this local impact issue during the outage?

- Denial of noncritical services

- Denial of critical services or loss of contro

Melissa is using the US-CERT's scale to measure the impact of the location of observed activity by a threat actor. Which of the following should be the highest rated threat activity location?

- Safety systems

Derek's organization has been working to recover from a recent malware infection that caused outages across the organization during an important part of their business cycle. To properly triage, what should Derek pay the most attention to first?

- The immediate impact on operations so that his team can restore functionality

Jeff discovers multiple JPEG photos during his forensic investigation of a computer involved in an incident. When he runs exiftool to gather file metadata, which information is not likely to be part of the images even if they have complete metadata intact?

- Number of copies made

John has designed his network as shown here and places untrusted svstems that want to connect to the network into the Guests network segment. What is this type of segmentation called?

- Proactive network segmentation

The organization that Jamal works for classifies security related events using NIST's standard definitions. Which classification should he use when he discovers key logging software on one of his frequent business travelers' laptop?

- A security incident

Dan is designing a segmented network that places systems with different levels of security requirements into different subnets with firewalls and other network security devices between them. What phase of the incident response process is Dan in?

- Preparation

Lauren wants to create a backup of Linux permissions before making changes to the Linux workstation she is attempting to remediate. What Linux tool can she use to back up the permissions of an entire directory on the system?

- She can use getfacl.

While working to restore systems to their original configuration after a long-term APT compromise, Manish has three options. A. He can restore from a backup and then update patches on the system. B. He can rebuild and patch the system using original installation media and application software using his organization's build documentation. C. He can remove the compromised accounts and rootkit tools and then fix the issues that allowed the attackers to access the systems. Which option should Manish choose in this scenario?

- Option B.

Jessica wants to access a macOS FileVault 2-encrypted drive. Which of the following methods is not a possible means of unlocking the volume?

- Change the File Vault key using a trusted user account.

Susan discovers the following log entries that occurred within seconds of each other in her Squert (a Sguil web interface) console. What have her network sensors most likely detected?

- A port scan

If Suki wants to purge a drive, which of the following options will accomplish her goal?

- Cryptographic erase

While performing post-rebuild validation efforts, Scott scans a server from a remote network and sees no vulnerabilities. Joanna, the administrator of the machine, runs a scan and discovers two critical vulnerabilities and five moderate issues. What is most likely causing the difference in their reports?

- There is a firewall between the remote network and the server.

As part of his organization's cooperation in a large criminal case, Adam's forensic team has been asked to send a forensic image of a highly sensitive compromised system in RAW format to an external forensic examiner. What steps should Adam's team take prior to sending a drive containing the forensic image?

- Encrypt the RAW file and transfer a hash and key under separate cover.

Mika wants to analyze the contents of a drive without causing any changes to the drive. What method is best suited to ensuring this?

- Use a write blocker.

What type of forensic investigation-related form is shown here?

- Chain of custody

James wants to determine whether other Windows systems on his network are infected with the same malware package that he has discovered on the workstation he is analyzing. He has removed the system from his network by unplugging its network cable, as required by corporate policy. He knows that the system has previously exhibited beaconing behavior and wants to use that behavior to identify other infected systems. How can he safely create a fingerprint for this beaconing without modifying the infected system?

- Plug the system into an isolated switch and use a span port or tap and Wireshark/tcpdump to capture traffic.

After completing an incident response process and providing a final report to management, what step should Casey use to identify improvement to her incident response plan?

- Conduct a lessons learned session.

During a forensic investigation, Lukas discovers that he needs to capture a virtual machine that is part of the critical operations of his company's website. If he cannot suspend or shut down the machine for business reasons, what imaging process should he follow?

- Copy the virtual disk files and then use a memory capture tool.

Mika, a computer forensic examiner, receives a PC and its peripherals that were seized as forensic evidence during an investigation. After she signs off on the chain of custody log and starts to prepare for her investigation, one of the first things she notes is that each cable and port was labeled with a color-coded sticker by the onsite team. Why are the items labeled like this?

- To ensure correct reassembly

While reviewing her Nagios logs, Selah discovers the error message shown here. What should she do about this error?

- Review the Apache error log.

Lakshman needs to sanitize hard drives that will be leaving his organization after a lease is over. The drives contained information that his organization classifies as sensitive data that competitors would find valuable if they could obtain it. Which choice is the most appropriate to ensure that data exposure does not occur during this process?

- Purge, validate, and document.

Selah is preparing to collect a forensic image for a Macintosh computer running the Ventura operating system. What hard drive format is she most likely to encounter ?

- APFS

During a forensic analysis of an employee's computer as part of a human resources investigation into misuse of company resources, Tim discovers a program called Eraser installed on the PC. What should Tim expect to find as part of his investigation?

- Antiforensic activities

Jessica wants to recover deleted files from slack space and needs to identify where the files begin and end. What is this process called?

- Data carving

Latisha is the IT manager for a small company and occasionally serves as the organization's information security officer. Who would be the most appropriate leader for her organization's CSIRT?

- She should select herself.

During her forensic analysis of a Windows system, Cynthia accesses the registry and checks \ \HKEY LOCAL MACHINE\SOFTWARE\Microsoft \Windows-NT\CurrentVersion \Winlogin (as shown here). What domain was the system connected to, and what was the username that would appear at login?

- No domain, administrator

Alex suspects that an attacker has modified a Linux executable using static libraries. Which of the following Linux commands is best suited to determining whether this has occurred?

- file

Because of external factors, Eric has only a limited time period to collect an image from a workstation. If he collects only specific files of interest, what type of acquisition has he performed?

- Logical

//////////////// During a forensic investigation, Kwame records information about each drive, including where it was acquired, who made the forensic copy, the MD5 hash of the drive, and other details. What term describes the process Kwame is using as he labels evidence with details of who acquired and validated it?

- Chain of custody

Susan needs to perform forensics on a virtual machine. What process should she use to ensure she gets all of the forensic data she may need?

- Suspend the machine and copy the contents of the directory it resides in.

Allison wants to access Chrome logs as part of a forensic investigation. What format is information about cookies, history, and saved form responses saved in?

- SQLite

While Chris is attempting to image a device, he encounters write issues and cannot write the image as currently set (refer to the image shown here). What issue is he most likely encountering?

- The destination drive is formatted FAT32.

Saanvi needs to validate the MD5 checksum of a file on a Windows system to ensure that there were no unauthorized changes to the binary file. He is not allowed to install any programs and cannot run files from external media or drives. What Windows utility can he use to get the MD5 hash of the file?

- certutil

Forensic investigation shows that the target of an investigation used the Windows Quick Format command to attempt to destroy evidence on a USB thumb drive. Which of the NIST sanitization techniques has the target of the investigation used in their attempt to conceal evidence?

- None of the above

During an incident response process, Susan plugs a system back into the network, allowing it normal network access. What phase of the incident response process is Susan performing?

- Containment, eradication, and recovery

Mei's team has completed the initial phases of their incident response process and is assessing the time required to recover from the incident. Using the NIST recoverability effort categories, the team has determined that they can predict the time to recover but will require additional resources. How should she categorize this using the NIST model?

- Supplemented

Janet is attempting to conceal her actions on a company-owned computer. As part of her cleanup attempts, she deletes all the files she downloaded from a corporate file server using a browser in incognito mode. How can a forensic investigator determine what files she downloaded?

- Drive analysis

Jose is aware that an attacker has compromised a system on his network but wants to continue to observe the attacker's efforts as they continue their attack. If Jose wants to prevent additional impact on his network while watching what the attacker does, what containment method should he use?

- Isolation

When Abdul arrived at work this morning, he found an email in his inbox that read, "Your systems are weak; we will own your network by the end of the week." How would he categorize this sign of a potential incident if he was using the NIST SP 800-61 descriptions of incident signs?

- A precursor

During an incident response process, Cynthia conducts a lessons learned review. What phase of the incident response process is she in?

- Post-incident recovery

As part of his incident response program, Allan is designing a playbook for zero-day threats. Which of the following should not be in his plan to handle them?

- Patching

As the CISO of her organization, Mei is working on an incident classification scheme and wants to base her design on NIST's definitions. Which of the following options should she use to best describe a user accessing a file that they are not authorized to view?

- An adverse event

Fred wants to identify digital evidence that can place an individual in a specific place at a specific time. Which of the following types of digital forensic data is not commonly used to attempt to document physical location at specific times?

- Microsoft Office document metadata

Kai has completed the validation process of her media sanitization efforts and has checked a sample of the drives she had purged using a built-in cryptographic wipe utility. What is her next step?

- Create documentation.

In his role as a small company's information security manager, Mike has a limited budget for hiring permanent staff. Although his team can handle simple virus infections, he does not currently have a way to handle significant information security incidents. Which of the following options should Mike investigate to ensure that his company is prepared for security incidents?

- Outsource to an incident response provider.

Bohai wants to ensure that media has been properly sanitized. Which of the following options properly lists sanitization descriptions from least to most effective?

- Clear, purge, destroy

Degaussing is an example of what form of media sanitization?

- Purging.

While reviewing storage usage on a Windows system, Brian checks the volume shadow copy storage as shown here: What purpose does this storage serve, and can he safely delete it?

- It provides a block-level snapshot and can be safely deleted.

Lauren recovers a number of 16GB and 32GB microSD cards during a forensic investigation. Without checking them manually, what filesystem type is she most likely to find them formatted in as if they were used with a digital camera?

- FAT32

After arriving at an investigation site, Brian determines that three powered-on computers need to be taken for forensic examination. What steps should he take before removing the PCs?

- Collect live forensic information, take photos of each system, and power them down.

In his role as a forensic examiner, Lukas has been asked to produce forensic evidence related to a civil case. What is this process called?

- E-discovery

As Mika studies her company's computer forensics playbook, she notices that forensic investigators are required to use a chain of custody form. Which of the following best describes the information that she should record on that form if she was conducting a forensic investigation?

- All individuals who work with evidence in the investigation

Scott needs to ensure that the system he just rebuilt after an incident is secure. Which type of scan will provide him with the most useful information to meet his goal?

- An authenticated vulnerability scan from a trusted internal network

What is the primary role of management in the incident response process?

- Providing authority and resources

Max wants to improve the effectiveness of the incident analysis process he is responsible for as the leader of his organization's CSIRT. Which of the following is not a commonly recommended best practice based on NIST's guidelines?

- Maintain backups of every system and device.

NIST describes four major phases in the incident response cycle. Which of the following is not one of the four?

- Notification and communication

Charles wants to perform memory forensics on a Windows system and wants to access pagefile.sys. When he attempts to copy it, he receives the following error. What access method is required to access the page file?

- Shut the system down, remove the drive, and copy it from another system.

Where is slack space found in the following Windows partition map?

- The System Reserved and C: partitions

Ty needs to determine the proper retention policy for his organization's incident data. If he wants to follow common industry practices and does not have specific legal or contractual obligations that he needs to meet, what timeframe should he select?

- 1 to 2 years

The system that Alice has identified as the source of beaconing traffic is one of her organization's critical e-commerce servers. To maintain her organization's operations, she needs to quickly restore the server to its original, uncompromised state. What criterion is likely to be impacted the most by this action?

- Ability to preserve evidence

Piper wants to create a forensic image that third-party investigators can use but does not know what tool the third-party investigation team that her company intends to engage will use. Which of the following forensic formats should she choose if she wants almost any forensic tool to be able to access the image?

- RAW

As part of his forensic investigation, Scott intends to make a forensic image of a network share that is mounted by the PC that is the focus of his investigation. What information will he be unable to capture?

- Deleted files

What common incident response follow-up activity includes asking questions like "What additional tools or resources are needed to detect or analyze future events?"

- Lessons learned review

Suki has been asked to capture forensic data from a Windows PC and needs to ensure that she captures the data in their order of volatility. Which order is correct from most to least volatile?

- CPU cache, network traffic, disk drives, optical media

During an incident response process, Suki heads to a compromised system and disconnects its network cable. What phase of the incident response process is Suki performing?

- Containment, eradication, and recovery

Scott needs to verify that the forensic image he has created is an exact duplicate of the original drive. Which of the following methods is considered forensically sound?

- All of the above

What strategy does NIST suggest for identifying attackers during an incident response process?

- Identifying attackers is not an important part of the incident response process.

While performing forensic analysis of an iPhone backup, Cynthia discovers that she has only some of the information that she expects the phone to contain. What is the most likely scenario that would result in the backup she is using having partial information?

- The backup is a differential backup.

Cullen wants to ensure that his chain of custody documentation will stand up to examination in court. Which of the following options will provide him with the best documentary proof of his actions?

- A second examiner acting as a witness and countersigning all actions

Cynthia is reviewing her organization's incident response recovery process, which is outlined here. Which of the following recommendations should she make to ensure that further issues do not occur during the restoration process?

- Isolate the system before restoring from backups.

Saria is reviewing the contents of a drive as part of a forensic effort and notes that the file she is reviewing takes up more space on the disk than its actual size, as shown here. What has she discovered?

- Slack space

Kathleen is restoring a critical business system to operation after a ma or compromise and needs to validate that the operating system and application files are legitimate and do not have any malicious code included in them. What type of tool should she use to validate this?

- A trusted system binary kit

Mel is creating the evidence log for a computer that was part of an attack on an external third-party system. What network-related information should he include in that log if he wants to follow NIST's recommendations?

- IP addresses, MAC addresses, hostname

Ryan believes that systems on his network have been compromised by an advanced persistent threat actor. He has observed a number of large file transfers outbound to remote sites via TLS-protected HTTP sessions from systems that do not typically send data to those locations. Which of the following techniques is most likely to detect the APT infections?

- Endpoint forensics

Ben is investigating a potential malware infection of a laptop belonging to a senior manager in the company he works for. When the manager opens a document, website, or other application that takes user input, words start to appear as though they are being typed. What is the first step that Ben should take in his investigation?

- Disconnect the system from the network.

Kathleen's forensic analysis of a laptop that is believed to have been used to access sensitive corporate data shows that the suspect tried to overwrite the data they downloaded as part of antiforensic activities by deleting the original files and then copying other files to the drive. Where is Kathleen most likely to find evidence of the original files?

- Slack space

Angela wants to access the decryption key for a BitLocker-encrypted system, but the system is currently turned off. Which of the following methods is a viable method if a Windows system is turned off?

- Hibernation file analysis

Adam believes that a system on his network is infected but does not know which system. To detect it, he creates a query for his network monitoring software based on the following pseudocode. What type of traffic is he most likely trying to detect?

- Beaconing

As an employee of the U.S. government, Megan is required to use NIST's information impact categories to classify security incidents. During a recent incident, proprietary information was changed. How should she classify this incident?

- As an integrity loss

During what stage of an event is preservation of evidence typically handled?

- Containment, eradication, and recovery

Lukas wants to purge a drive to ensure that data cannot be extracted when it is sent offsite. Which of the following is not a valid option for purging hard drives on a Windows system?

- Use the built-in Windows delete command line.

Which of the following is not a valid use case for live forensic imaging?

- Postmortem forensics

100

While reviewing the actions taken during an incident response process, Mei is informed by the local desktop support staff person that the infected machine was returned to service by using a Windows System Restore point. Which of the following items will a Windows System Restore return to a previous state?

- Windows system files

THE P.T: 1 CHRONICLE: ( ex.9 )

The R.S.S.H Delivery Company · 90問 · 6ヶ月前

THE P.T: 1 CHRONICLE: ( ex.9 )