Refer to the exhibit. How must these advisories be prioritized for handling?
AThe highest priority for handling depends on the type of institution deploying the devices
BVulnerability #2 is the highest priority for every type of institution
CVulnerability #1 and vulnerability #2 have the same priority
DVulnerability #1 is the highest priority for every type of institution
An engineer is going through vulnerability triage with company management because of a recent malware outbreak from which 21 affected assets need to be patched or remediated. Management decides not to prioritize fixing the assets and accepts the vulnerabilities. What is the next step the engineer should take?
AInvestigate the vulnerability to prevent further spread
BAcknowledge the vulnerabilities and document the risk
CApply vendor patches or available hot fixes
DIsolate the assets affected in a separate network
The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?
ADetermine the assets to which the attacker has access
BIdentify assets the attacker handled or acquired
CChange access controls to high risk assets in the enterprise
DIdentify movement of the attacker in the enterprise
A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?
AClassify the criticality of the information, research the attacker's motives, and identify missing patches
BDetermine the damage to the business, extract reports, and save evidence according to a chain of custody
CClassify the attack vector, understand the scope of the event, and identify the vulnerabilities being exploited
DDetermine the attack surface, evaluate the risks involved, and communicate the incident according to the escalation plan
Question 6
Processes
0
Question 7
Processes
Question 8
Processes
Question 9
Processes
Question 10
Techniques
Question 11
Techniques
Question 12
Fundamentals
Question 13
Automation
Question 14
Techniques
Question 15
Processes
Question 16
Techniques
Question 17
Fundamentals
Question 18
Techniques
Question 19
Fundamentals
Question 20
Processes
Question 21
Fundamentals
Question 22
Fundamentals
Question 23
Fundamentals
Question 24
Fundamentals
Question 25
Fundamentals
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ad
Want a break from the ads?
Become a Supporter and enjoy a completely ad-free experience, plus unlock Learn Mode, Exam Mode, AstroTutor AI, and more.
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?
AHost a discovery meeting and define configuration and policy updates
BUpdate the IDS/IPS signatures and reimage the affected hosts
CIdentify the systems that have been affected and tools used to detect the attack
DIdentify the traffic with data capture using Wireshark and review email filters
The incident response team receives information about the abnormal behavior of a host. A malicious file is found being executed from an external USB flash drive.
The team collects and documents all the necessary evidence from the computing resource. What is the next step?
AConduct a risk assessment of systems and applications
BIsolate the infected host from the rest of the subnet
CInstall malware prevention software on the host
DAnalyze network traffic on the host's subnet
DRAG DROP -
Drag and drop the actions below the image onto the boxes in the image for the actions that should be taken during this playbook step. Not all options are used.
Select and Place:
The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?
AContain the malware
BInstall IPS software
CDetermine the escalation path
DPerform vulnerability assessment
Refer to the exhibit. Which command was executed in PowerShell to generate this log?
AGet-EventLog -LogName*
BGet-EventLog -List
CGet-WinEvent -ListLog* -ComputerName localhost
DGet-WinEvent -ListLog*
Refer to the exhibit. Cisco Rapid Threat Containment using Cisco Secure Network Analytics (Stealthwatch) and ISE detects the threat of malware-infected 802.1x authenticated endpoints and places that endpoint into a Quarantine VLAN using Adaptive Network Control policy. Which telemetry feeds were correlated with
SMC to identify the malware?
ANetFlow and event data
Bevent data and syslog data
CSNMP and syslog data
DNetFlow and SNMP
What is the HTTP response code when the REST API information requested by the authenticated user cannot be found?
A401
B402
C403
D404
E405
Refer to the exhibit. An organization is using an internal application for printing documents that requires a separate registration on the website. The application allows format-free user creation, and users must match these required conditions to comply with the company's user creation policy:
✑ minimum length: 3
✑ usernames can only use letters, numbers, dots, and underscores
✑ usernames cannot begin with a number
The application administrator has to manually change and track these daily to ensure compliance. An engineer is tasked to implement a script to automate the process according to the company user creation policy. The engineer implemented this piece of code within the application, but users are still able to create format-free usernames. Which change is needed to apply the restrictions?
Amodify code to return error on restrictions def return false_user(username, minlen)
Bautomate the restrictions def automate_user(username, minlen)
Cvalidate the restrictions, def validate_user(username, minlen)
Dmodify code to force the restrictions, def force_user(username, minlen)
Refer to the exhibit. Which code snippet will parse the response to identify the status of the domain as malicious, clean or undefined?
A.
B.
C.
D.
An engineer received an alert of a zero-day vulnerability affecting desktop phones through which an attacker sends a crafted packet to a device, resets the credentials, makes the device unavailable, and allows a default administrator account login. Which step should an engineer take after receiving this alert?
AInitiate a triage meeting to acknowledge the vulnerability and its potential impact
BDetermine company usage of the affected products
CSearch for a patch to install from the vendor
DImplement restrictions within the VoIP VLANS
Refer to the exhibit. An engineer is analyzing this Vlan0392-int12-239.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?
AThe extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible
BThe traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information
CThere is a possible data leak because payloads should be encoded as UTF-8 text
DThere is a malware that is communicating via encrypted channels to the command and control server
An employee abused PowerShell commands and script interpreters, which lead to an indicator of compromise (IOC) trigger. The IOC event shows that a known malicious file has been executed, and there is an increased likelihood of a breach. Which indicator generated this IOC event?
AExecutedMalware.ioc
BCrossrider.ioc
CConnectToSuspiciousDomain.ioc
DW32.AccesschkUtility.ioc
An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?
AModify the alert rule to ג€output alert_syslog: output logג€
BModify the output module rule to ג€output alert_quick: output filenameג€
CModify the alert rule to ג€output alert_syslog: output headerג€
DModify the output module rule to ג€output alert_fast: output filenameג€
What is a principle of Infrastructure as Code?
ASystem maintenance is delegated to software systems
BComprehensive initial designs support robust systems
CScripts and manual configurations work together to ensure repeatable routines
DSystem downtime is grouped and scheduled across the infrastructure
An engineer is moving data from NAS servers in different departments to a combined storage database so that the data can be accessed and analyzed by the organization on-demand. Which data management process is being used?
Adata clustering
Bdata regression
Cdata ingestion
Ddata obfuscation
DRAG DROP -
Drag and drop the cloud computing service descriptions from the left onto the cloud service categories on the right.
Select and Place:
Refer to the exhibit. How are tokens authenticated when the REST API on a device is accessed from a REST API client?
AThe token is obtained by providing a password. The REST client requests access to a resource using the access token. The REST API validates the access token and gives access to the resource.
BThe token is obtained by providing a password. The REST API requests access to a resource using the access token, validates the access token, and gives access to the resource.
CThe token is obtained before providing a password. The REST API provides resource access, refreshes tokens, and returns them to the REST client. The REST client requests access to a resource using the access token.
DThe token is obtained before providing a password. The REST client provides access to a resource using the access token. The REST API encrypts the access token and gives access to the resource.
Refer to the exhibit. Where are the browser page rendering permissions displayed?
Ax-frame-options
Bx-xss-protection
Cx-content-type-options
Dx-test-debug
Refer to the exhibit. Where is the MIME type that should be followed indicated?
Ax-test-debug
Bstrict-transport-security
Cx-xss-protection
Dx-content-type-options
A company recently started accepting credit card payments in their local warehouses and is undergoing a PCI audit. Based on business requirements, the company needs to store sensitive authentication data for 45 days. How must data be stored for compliance?
Apost-authorization by non-issuing entities if there is a documented business justification
Bby entities that issue the payment cards or that perform support issuing services
Cpost-authorization by non-issuing entities if the data is encrypted and securely stored
Dby issuers and issuer processors if there is a legitimate reason