151-175 Flashcards
A SOC operator is analyzing a log file that contains the following entries:
[06-apr-2021-18:00:06] GET /index.php/../../../../../etc/passwd
[06-apr-2021-18:01:07] GET /index.php/../../../../../etc/shadow
[06-apr-2021-18:01:26] GET /index.php/../../../../../../../../etc/passwd
[06-apr-2021-18:02:16] GET /index.php?varl=;cat /etc/passwd;&var2=7865tgydk
Which of the following explains these log entries?
A. SQL injection and improper input-handling attempts
B. Cross-site scripting and resource exhaustion attempts
C. Command injection and directory traversal attempts
D. Error handling and privilege escalation attempts
C. Command injection and directory traversal attempts
A security incident has been resolved. Which of the following BEST describes the importance of the final phase of the incident response plan?
A. It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.
B. It returns the affected systems back into production once systems have been fully patched, data restored, and vulnerabilities addressed.
C. It identifies the incident and the scope of the breach, how it affects the production environment, and the ingress point.
D. It contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach.
A. It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.
HOTSPOT -
Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation.
INSTRUCTIONS -
Not all attacks and remediation actions will be used.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Hot Area:
Botnet - enable DDOS protection
RAT - Disabl remot access service
Worm - Change default application password
Keylogger - Implement 2FA
Backdoor - Conduct Code Review
During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user’s intranet account? (Choose two.)
A. Federation
B. Identity proofing
C. Password complexity
D. Default password changes
E. Password manager
F. Open authentication
A. Federation
C. Password complexity
SIMULATION -
An attack has occurred against a company.
INSTRUCTIONS -
You have been tasked to do the following:
✑ Identify the type of attack that is occurring on the network by clicking on the attacker’s tablet and reviewing the output.
✑ Identify which compensating controls a developer should implement on the assets, in order to reduce the effectiveness of future attacks by dragging them to the correct server.
All objects will be used, but not all placeholders may be filled. Objects may only be used once.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Word Doc
SIMULATION -
A systems administrator needs to install a new wireless network for authenticated guest access. The wireless network should support 802.1X using the most secure encryption and protocol available.
Word Doc
HOTSPOT - SIM
An incident has occurred in the production environment.
INSTRUCTIONS -
Analyze the command outputs and identify the type of compromise.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Hot Area:
Logic Bomb, Backdoor
After a recent security incident, a security analyst discovered that unnecessary ports were open on a firewall policy for a web server. Which of the following firewall polices would be MOST secure for a web server?
A
[Source Destination Port Action]
Any Any TCP 53 Allow
Any Any TCP 80 Allow
Any Any TCP 443 Allow
Any Any Any Any
B
[Source Destination Port Action]
Any Any TCP 53 Deny
Any Any TCP 80 Allow
Any Any TCP 443 Allow
Any Any Any Allow
C
[Source Destination Port Action]
Any Any TCP 80 Deny
Any Any TCP 443 Allow
Any Any Any Allow
D
[Source Destination Port Action]
Any Any TCP 80 Allow
Any Any TCP 443 Allow
Any Any Any Deny
D
[Source Destination Port Action]
Any Any TCP 80 Allow
Any Any TCP 443 Allow
Any Any Any Deny
A large bank with two geographically dispersed data centers is concerned about major power disruptions at both locations. Every day each location experiences very brief outages that last for a few seconds. However, during the summer a high risk of intentional brownouts that last up to an hour exists, particularly at one of the locations near an industrial smelter. Which of the following is the BEST solution to reduce the risk of data loss?
A. Dual supply
B. Generator
C. UPS
D. POU
E. Daily backups
C. UPS
Which of the following would be the BEST way to analyze diskless malware that has infected a VDI?
A. Shut down the VDI and copy off the event logs.
B. Take a memory snapshot of the running system.
C. Use NetFlow to identify command-and-control IPs.
D. Run a full on-demand scan of the root volume.
B. Take a memory snapshot of the running system.
Users are presented with a banner upon each login to a workstation. The banner mentions that users are not entitled to any reasonable expectation of privacy and access is for authorized personnel only. In order to proceed past that banner, users must click the OK button. Which of the following is this an example of?
A. AUP
B. NDA
C. SLA
D. MOU
A. AUP
The Chief Information Security Officer is concerned about employees using personal email rather than company email to communicate with clients and sending sensitive business information and PII. Which of the following would be the BEST solution to install on the employees’ workstations to prevent information from leaving the company’s network?
A. HIPS
B. DLP
C. HIDS
D. EDR
B. DLP
On the way into a secure building, an unknown individual strikes up a conversation with an employee. The employee scans the required badge at the door while the unknown individual holds the door open, seemingly out of courtesy, for the employee. Which of the following social engineering techniques is being utilized?
A. Shoulder surfing
B. Watering-hole attack
C. Tailgating
D. Impersonation
C. Tailgating
Two hospitals merged into a single organization. The privacy officer requested a review of all records to ensure encryption was used during record storage, in compliance with regulations. During the review, the officer discovered that medical diagnosis codes and patient names were left unsecured. Which of the following types of data does this combination BEST represent?
A. Personal health information
B. Personally identifiable information
C. Tokenized data
D. Proprietary data
A. Personal health information
A company discovered that terabytes of data have been exfiltrated over the past year after an employee clicked on an email link. The threat continued to evolve and remain undetected until a security analyst noticed an abnormal amount of external connections when the employee was not working. Which of the following is the MOST likely threat actor?
A. Shadow IT
B. Script kiddies
C. APT
D. Insider threat
C. APT
