Pg20 Flashcards
(16 cards)
A user clicks on a malicious adware link, and the malware successfully downloads to the machine. The malware has a script that invokes command-and-control activity. Which of the following actions is the best way to contain the incident without any additional impact?
A. Disable the user account until the malware investigation is complete.
B. Review EDR information to determine whether the file was detected and quarantined locally.
C. Block the server on the proxy and firewall.
D. Submit a recategorization update to the vendor.
Block the server on the proxy and firewall.
During normal security monitoring activities, the following activity was observed:
cd C:\Users\Documents\HR\Employees
takeown/f .*
SUCCESS:
Which of the following best describes the potentially malicious activity observed?
A. Registry changes or anomalies
B. Data exfiltration
C. Unauthorized privileges
D. File configuration changes
Unauthorized privileges
Question #384Topic 1
Which of the following should be performed first when creating a BCP to ensure that all critical functions and financial implications have been considered?
A. Failover test
B. Tabletop exercise
C. Security policies
D. Business impact analysis
Business impact analysis
Which of the following best describes root cause analysis?
A. It describes the tactics, techniques, and procedures used in an incident.
B. It provides a detailed path outlining the origin of an issue and how to eliminate it permanently.
C. It outlines the who-what-when-where-why, which is often used in conjunction with legal proceedings.
D. It generates a report of ongoing activities, including what was done, what is being done, and what will be done next.
It provides a detailed path outlining the origin of an issue and how to eliminate it permanently.
A security administrator has found indications of dictionary attacks against the company’s external-facing portal. Which of the following should be implemented to best mitigate the password attacks?
A. Multifactor authentication
B. Password complexity
C. Web application firewall
D. Lockout policy
Password complexity
A security analyst has identified outgoing network traffic leaving the enterprise at odd times. The traffic appears to pivot across network segments and target domain servers. The traffic is then routed to a geographic location to which the company has no association. Which of the following best describes this type of threat?
A. Hacktivist
B. Zombie
C. Insider threat
D. Nation-state actor
Nation-state actor
Based on an internal assessment, a vulnerability management team wants to proactively identify risks to the infrastructure prior to production deployments. Which of the following best supports this approach?
A. Threat modeling
B. Penetration testing
C. Bug bounty
D. SDLC training
Threat modeling
Which of the following best explains the importance of utilizing an incident response playbook?
A. It prioritizes the business-critical assets for data recovery.
B. It establishes actions to execute when inputs trigger an event.
C. It documents the organization asset management and configuration.
D. It defines how many disaster recovery sites should be staged.
It establishes actions to execute when inputs trigger an event.
Question #391Topic 1
Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?
A. Routing table, registers, physical memory, archival media, hard disk, physical configuration
B. Routing table, registers, physical memory, temporary partition, hard disk, physical configuration
C. Cache, routing table, physical memory, network topology, temporary partition, hard disk
D. Cache, routing table, physical memory, temporary partition, hard disk, physical configuration
Cache, routing table, physical memory, temporary partition, hard disk, physical configuration
A security analyst needs to support an organization’s legal case against a threat actor. Which of the following processes provides the best way to assist in the prosecution of the case?
A. Chain of custody
B. Evidence gathering
C. Securing the scene
D. Forensic analysis
Chain of custody
An end user forwarded an email with a file attachment to the SOC for review. The SOC analysts think the file was specially crafted for the target. Which of the following investigative actions would best determine if the attachment was malicious?
A. Review the file in Virus Total to determine if the domain is associated with any phishing.
B. Review the email header to analyze the DKIM, DMARC, and SPF values.
C. Review the source IP address in AbuseIPDB.
D. Review the attachment’s behavior in a sandbox environment while running Wireshark.
Review the attachment’s behavior in a sandbox environment while running Wireshark.
Which of the following is instituting a security policy that users must lock their systems when stepping away from their desks an example of?
A. Configuration management
B. Compensating control
C. Awareness, education, and training
D. Administrative control
Administrative control
Which of the following is the best metric to use when reviewing and addressing findings that caused an incident?
A. Mean time to restore
B. Mean time to respond
C. Mean time to remediate
D. Mean time to detect
Mean time to remediate
A cybersecurity analyst is setting up a security control that monitors network traffic and produces an active response to a security event. Which of the following tools is the analyst configuring?
A. EDR
B. IPS
C. CASB
D. WAF
IPS
A security analyst working for an airline is prioritizing vulnerabilities found on a system. The system has the following requirements:
- Can store periodically audited documents required for takeoffs and landings
- Can keep critical records regarding the company’s operations
- Data can be made public upon request and authorization
Which of the following vulnerabilities should be remediated first?
A. A broken access control vulnerability impacting data integrity
B. A heap overflow vulnerability impacting the system’s usability
C. A DoS vulnerability impacting the system’s availability
D. A zero-day vulnerability impacting the system’s confidentiality
A broken access control vulnerability impacting data integrity
Which of the following are process improvements that can be realized by implementing a SOAR solution? (Choose two.)
A. Minimize security attacks.
B. Itemize tasks for approval.
C. Reduce repetitive tasks.
D. Minimize setup complexity.
E. Define a security strategy.
F. Generate reports and metrics.
Reduce repetitive tasks.
Generate reports and metrics.
