- All Exams Instant Download
Which of the following most likely describes the observed activity?
A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?A . There is an issue with the SSL certificate causinq port...
Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?
An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?A . Hard diskB . Primary boot partitionC...
Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?
A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?A . function x() { info=$(geoiplookup $1) && echo "$1 | $info" }B . function x() { info=$(ping -c 1...
Which of the following would be the best way to locate this issue?
During an audit, several customer order forms were found to contain inconsistencies between the actual price of an item and the amount charged to the customer. Further investigation narrowed the cause of the issue to manipulation of the public-facing web form used by customers to order products. Which of the...
Which of the following is the most likely reason to include lessons learned?
An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?A . To satisfy regulatory requirements for incident reportingB ....
Which of the following most likely describes the observed activity?
A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?A . There is an issue with the SSL certificate causinq port...
Which of the following best describes the potential security concern?
The following output is from a tcpdump al the edge of the corporate network: Which of the following best describes the potential security concern?A . Payload lengths may be used to overflow buffers enabling code execution.B . Encapsulated traffic may evade security monitoring and defensesC . This traffic exhibits a...
Which of the following actions should the analyst perform next to ensure the data integrity of the evidence?
During an incident response procedure, a security analyst acquired the needed evidence from the hard drive of a compromised machine. Which of the following actions should the analyst perform next to ensure the data integrity of the evidence?A . Generate hashes for each file from the hard drive.B . Create...
Which of the following is the best way for the security analyst to respond?
A security analyst is monitoring a company's network traffic and finds ping requests going to accounting and human resources servers from a SQL server. Upon investigation, the analyst discovers a technician responded to potential network connectivity issues. Which of the following is the best way for the security analyst to...
Which of the following should be the next step in the remediation process?
A technician identifies a vulnerability on a server and applies a software patch. Which of the following should be the next step in the remediation process?A . TestingB . ImplementationC . ValidationD . RollbackView AnswerAnswer: C Explanation: The next step in the remediation process after applying a software patch is...
