Quiz
Principles of Information Security and Detection
This quiz has question types that open in the usual player.
Questions in this quiz (200)
1Which event is user interaction?
Qual evento é a interação do usuário?- Againing root access
- Bexecuting remote code
- CReading and writing file permission
- Dopening a malicious file
2Which security principie requeries more tan one person is required to perform a critical task?
Qual princípio de segurança exige mais do que uma pessoa é necessária para executar uma tarefa crítica?)- Aleast privilegie (Ultimo privilégio)
- Bneed to know (precisa saber)
- Cseparation of duties (Separação de Deveres)
- Ddue diligence
3how is attacking a vulnerability categorized? (como o ataque a uma vulnerabilidade é categorizado?)
- Aaction on objectives
- Bdelivery
- Cexploitation
- Dinstallation
4What is benefit of agent-based protection when compared to agentless protection? (Qual é o benefício da proteção baseada em agente em comparação com a proteção sem agente?)
- Ait lowers maintenance costs
- Bit provides a centralized plataform
- Cit collects and detects all traffic locally
- Dit manages numerous devices simultaneously
5Which principle is being followed when an analyst gather information relevant to a security incident to determine the appropriate course of action? (Qual princípio está sendo seguido quando um analista coleta informações relevantes para um incidente de segurança para determinar o curso de ação apropriado?)
- Adecision making
- Brapid response
- Cdata mining
- Ddue diligence
6One of the objetives of information security is to protec the CIA of information and systems. Whats does CIA mean in this context? (Um dos objetivos da segurança da informação é proteger a CIA das informações e dos sistemas. O que CIA significa neste contexto?)
- Aconfidentiality, identity and authorization
- Bconfidentiality, integrity and authorization
- Cconfidentiality, identity and availability
- Dconfidentiality,integrity and availability
7What is rule-based detecton when compared to statistical detection? (O que é detecção baseada em regras quando comparada à detecção estatística?)
- Aproof of a user´s identity
- Bproof of a user-s action
- Clikelihood of user-s action
- Dfalsification of a user´s indentity
8A user received a malicious attachment but did not run it. Which category classifies the intrusion? (Um usuário recebeu um anexo malicioso, mas não o executou. Qual categoria classifica a intrusão?)
- Aweaponization
- Breconnaissance
- Cinstallation
- Ddelivery
9 Which process is used when IPS events ae removed to imporve data integrity? (Qual processo é usado quando os eventos IPS são removidos para melhorar a integridade dos dados?)
- Adata availability
- Bdata normalization
- Cdata signature
- Ddata protection
10An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs? (Um analista está investigando um incidente em um ambiente SOC. Qual método é usado para identificar uma sessão de um grupo de logs?)
- Asequence numbers
- BIP identifier
- C5-tuple
- Dtimestamps
11What is a difference between SOAR and SIEM (Qual é a diferença entre SOAR e SIEM)
- ASOAR platforms are used for threat and vulnerability management, but SIEM applications are not
- BSIEM applications are used for threat and vulnerability management, but SOAR plataforms are not
- CSOAR receives information from a single platform and delivers it to a SIEM
- DSIEM receives information from a single platform ad delivers it to a SOAR
12What is the difference between mandatory access control (MAC) and discretionary access control (DAC)? (Qual é a diferença entre controle de acesso obrigatório (MAC) e controle de acesso discricionário (DAC)?)
- AMAC is controlled by the discretion of the owner and DAC is controlled by an administrator
- BMAC is the strictest of all levels of control and DAC is object-based access
- CDAC is controlled by the operation system and MAC is controlled by an administrator
- DDAC is the strictest of all levels of control and MAC is object-based access
13What is the practice of giving employees only those permissions necessary to perform their specific role within an organization? (Qual é a prática de conceder aos funcionários apenas as permissões necessárias para desempenhar sua função específica dentro de uma organização?)
- Aleast privilegie
- Bneed to know
- Cintegrity validation
- Ddue diligence
14What is the virtual addresss space for a Windows process? (Qual é o espaço de endereços virtuais para um processo do Windows?)
- Aphysical location of an object in memory
- Bset of pages that reside in the physical memory
- Csystem-level memory protection feature built into the operation system
- Dset of virtual memory adresses that can be used
15Which security principle is violated bu running all processes as root or administrator?
- Aprinciple of least privilegie
- Brole-based access control
- Cseparation of duties
- Dtrusted computing base
16What is the function of a command and control server?
- Ait enumerates open ports on a network device
- Bit drops secondary payload into malware
- Cit is used to regain control of the network after a compromisse
- Dit sends instruction to a compromissed system
17What is the difference between deep packet inspection and stateful inspection?
- ADeep packet inspection is more secure than stateful inspection on Layer 4
- BStateful inspection verifies contentes at Layer 4 and deep packet inspection verifies connection at Layer 7
- CStateful inspection is more secure than deep packet inspection on Layer 7
- DDeep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4
18Which evasion technique is a funciont of ransoware?
- Aextended sleep calls
- Bencryption
- Cresource exhaustion
- Dencoding
19Refer to the exhibit
Figura
Which two elements in the table are parts of the 5-tUPLE? (Choose two)- AFirst Packet
- BInitiator User
- CIngress Security Zone
- DSource Port
- EInitiator IP
20Risk Assessment --> network is compromised --- Threat
Vulnerability --> lack of an access list --- [blank_start]Vulnerability[blank_end]
Exploit --> configuration review --- Risk Assessment
threat --> leakage of confidential information --- Exploit- AThreat
- BVulnerability
- CRisk Assessment
- DExploit
21What is the difference between statistical detection and rule-based detection models?
- ARule-based detection involves the collection of data in relation to the behavior of legitimate users over a period of time
- BStatistical detection defines legitimate data of users over a period of time and rule-based detection defines it on an IF/THEN basis
- CStatistical detection involves the evaluation of an object on its intended actions before it executes that behavior
- DRule-based detection efines legitimate data of users over a period of time and statistical detection defines it on an IF/THEN basis
22What is the difference between a threat and risk?
- AThreat represents a potential danger that could take advantage of a weakness in a system
- BRisk represents the known and identified loss or danger in the system
- CRisk representes the nonintentional interaction with uncertainty in the system
- DThreat representes a state of being exposed to an attack or a compromisse, either physically or logically
23Which attack method intercepts traffic on a switched network?
- Adenial of service
- BARP cache poisoning
- CDHCP snooping
- Dcommand and control
24What does an attacker use to determine which network ports are listening on a potential target device?
- Aman-in-the-middle
- Bport scanning
- CSQL injection
- Dping sweep
25What is a purpose of a vulnerability management framework?
- Aidentifies, removes, and mitigates system vulnerabilities
- Bdetects and removes vulnerabilities in source code
- Cconducts vulnerability scans on the network
- Dmanages a list of reported vulnerabilities
26A network engineer discovers that a foreign government hacked one of the defese contractors in their home country and stole intelectual property. What is the threat agente in this situation? (Um engenheiro de rede descobre que um governo estrangeiro hackeou um dos prestadores de serviços de defesa em seu país de origem e roubou propriedade intelectual. Qual é o agente da ameaça nesta situação?)
- Athe intelectual property that was stolen
- Bthe defense contractor who stored the intelectual property
- Cthe method used to conduct the attack
- Dthe foreign government that conducted the attack
27What is the practice of giving an employee access to only the resources neede to accomplish their job?
- Aprinciple of least privilege
- Borganizational separation
- Cseparation of duties
- Dneed to know principle
28Which metric is used to capture the level of access needed to lauch a successful attack?
- Aprivileges required
- Buser interaction
- Cattack complexity
- Dattack vector
29What is the difference between an attack vector and attack surface?
- AAn attack surface identifies vulnerabilities that require user input or validation; and an attack vector identifies vulnerabilities that are independent of user actions.
- BAn attack vector identifies components that can be exploited, and an attack surface identifies the potential path an attack can take to penetrate the network.
- CAn attack surface recognizes which network parts are vulnerable to an attack; and an attack vector identifies which attacks are possible eith these vulnerabilities.
- DAn attack vector identifies the potential outcomes of an attack; and an attack surface lauches an attack
30Which metric in CVSS indicates an attack that takes a destination bank Account number and replaces it with a diferente bank Account number?
*/*- Aintegrity
- Bconfidentiality
- Cavailability
- Dscope
31A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver. Which event category is described?
- Areconnaissance
- Baction on objectives
- Cinstallation
- Dexploitation
32What specific type of analysis is assigning values to the scenario to see expected outcomes?
- Adeterministic
- Bexploratory
- Cprobabilistic
- Ddescriptive
33When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password ?
- Afragmentation
- Bpivoting
- Cencryption
- Dstenography
34Why is encryption challenging to security monitoring ?
- AEncryption analysis is used by attackers to monitor VPN tunnels
- BEncryption is used by threat actors as a method of evasion and obfuscation
- CEncryption introduces additional processing requirements by the CPU
- DEncryption introduces larger packet sizes to analyze and store
35Na employee reports that someone has logged into their system and made unapproved changes, files, are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the systema logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; ther are no alerts from antivírus and no failed login attempts. What is causing the lack of data visibility needed to detect the attack?
- AThe threat actor used a dictionary-based password attack to obtain credentials
- BThe threat actor gained access to the system by known credentials
- CThe threat actor used the teardrop techinique to confuse and crash login services
- DThe threat actor used an unknown vulnerability of the operation system that went undetected
36A company receptionist received a threatening call referencing stealing assest and did not take any action assuming it was a social engineering within 48 hours, multiple assets were breached, affecting the confidentiality of sensitive information. What is the threat actor in this incident?
- Acompany assets that are threatened
- BCustomer assets that are threatened
- Cperpetrators of the attack
- Dvictims of the attack
37What is the relationship between a vulnerability and threat?
- AA threat exploits a vulnerability
- BA vulnerability is a calculation of the potential loss caused by a threat
- CA vulnerability exploits a threat
- DA threat is a calculation of the potential loss caused by a vulnerability
38What is the principle of defense-in-depth?
- AAgentless and agent-based protection for security are used
- BSeveral distinct protective layers ara involved
- CAccess control models are involved
- DAuthentications,autorization, and accounting mechanisms are used
39Drag and Drop the uses on the left onto the type pf security system on the right
ensures protecion of individual devices --> endpoint
detects intrusion attempts --> network
monitors host for suspicious activity --> network
monitors incoming traffic and connections --> endpoint- Aendpoint
- Bssss
- Csssss
- Dssssss
40What is the difference between the rule-based detection when compared to behavioral detection?
- ARule-Based detection is searching for patterns linked to specific types of attacks, while behavioral is identifying per signature
- BRule-baed systems have established patterns that do not change with new data, while behavioral changes
- CBehavioral systems are predefined patterns from hundreds of users, while Rule-Based only flags potentially abnormal patterns using signatures
- DBehavioral systems find sequences that match a partícula attack signature, while rule-based identifies potential attacks -- correta
41Which open-sourced packet capture tool uses Linux and Mac OS x operating system?
- ANetScout
- Btcpdump
- Csolarwinds
- Dnetsh
42Refer to the exhibit
<IMG SRC=j%41vascript:alert('attack')>
Which kind of attack method is depicted in this string?- Across-site scripting
- Bman-in-the-middle
- Csql injection
- Ddenial of service
43Which two componentes reduce the attack surface on an endpoint? (Choose two)
- Asecure boot
- Bload balancing
- Cincreased audit log levels
- Drestricting USB ports
- Efull packet captures at the endpoint
44What is an attack surface as compared to a vulnerability?
- Aany potential danger to an asset
- Bthe sum of all paths for data into and out of the environment
- Can exploitable weakness in a system or its design
- Dthe individuals who perform an attack
45Na intruder attempted malicious activity and exchanged e-mails with a user and received corporate information, incluing email distribuition lists. The intruder asked the user to engage with a link in an email. When the fink lauched, it infected machines and the intruder was able to access the corporate network.
- Asocial engineering
- Beavesdropping
- Cpiggybacking
- Dtailgating
46What are two social egineering techniques? (Choose two)
- Aprivilegie escalation
- BDDoS attack
- Cphishing
- Dman-in-the-middle
- Epharming
47Refer to the exhibit
é uma figura com o comando nmap -aV 172.18.104.139
What does the output indicate about the server with the IP 172.18.104.139?- Aopen ports of a web server
- Bopen port of an FTP Server
- Copen ports of an email server
- Drunning processes of the server
48How does certificate authority impact a security system ?
- Ait authenticates cliente identify when requesting SSL certificate
- Bit validates domain identify of a SSL certificate
- Cit authenticates domain identity when requesting SSL certificate
- Dit validates cliente identity when communicating with the server
49When communicating via TLS, the cliente initiates the handshake to the server and the server responds back with its certificate for identification.
Which information is available on the server certificate?- Aserver name, trusted subrdinate CA, and private key
- Btrusted subordinate CA, public key and cipher suítes
- Ctrusted CA name, cipher suítes, and private key
- Dserver name, trustes CA and public key
50How does an SSL certificate impact security between the cliente and the server?
- Aby enabling an authenticated channel between the client and the server
- Bby creating an integrated channel between the client andthe server
- Cby enabling an authorized channel between the client and the server
- Dby creating an encrypted channel between the client and the server
51Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?
- Aforgery attack
- Bplaintext-only attack
- Cciphertext-only attack
- Dmeet-in-the-middle attack
52Which list identifies the information that the client sends to the server in the negotiation phase of the TLS handshake?
- AClientStart, ClientKeyExchange, cipher-suites it supports, and suggested compression methods
- BClientStart, TLS versions it supports, cipher-suites it supports, and suggested compression methods
- CClientHello, TLS versions it supports, cipher-suites it supports, and suggested compression methods
- DClientHello, ClientKeyExchange, cipher-suites it supports, and suggested compression methods
53 Refer to the exhibit
é um quadro com as informações do IDS: Severity, Date, time, Sig ID, Source IP, Dest IP, Dest Port, Description
Which type of log is displayed?- AIDS
- BPROXY
- CNetFlow
- DSYS
54Refer to the exhibit
Quadro com as informações do NetFlow: Data first seen, duration, Src ip Addr, Flows, Packets, Byte, pps, bps, bpp
What information is depicted?- AIIS data
- BNetFlow data
- Cnetwork Discovery event
- DIPS event data
55What is the difference between the ACK flag and the RST flag in the NetFlow log session?
- AThe RST flag confirms the beginning of the TCP connection, and the ACK flag responds when the data for the payload is complete
- BThe ACK flag confirms the beginning of the TCP connection, and the RST flag responds when the data for the plyload is complete
- CThe RST flag confirms the receipt of the prior segment, and the ACK flag allows for the spontaneous termination of a connection
- DThe ACK flag confirms the receipt of the prior segment, and the RST flag allows for the spontaneous termination of a connection
56Refer to the exhibit
Quadro com as informações do : Data, Flow Start, Duration, Proto, Src IP Addr. Port, Dst IP addr Port, Packets, Bytes, Flows
Which type of log is displayed?- Aproxy
- BNetFlow
- CIDS
- DSYS
57How is NetFlow diferente from traffic mirroring?
- ANetFlow collects metadata and traffic mirroring clones data
- BTraffic mirroring impacts switch performance and NetFlow does not
- CTraffic mirroring costs less to operat tan NetFlow
- DNetFlow generates more data than traffic a mirroring
58What makes HTTPS traffic difficult to monitor?
- ASSL interception
- Bpacket header size
- Csignature detection time
- Dencryption
59How does an attacker observe network traffic exchanged between two users?
- Aport scanning
- Bman-in-the-middle
- Ccommand injection
- Ddenial of service
60Which type of data consists of connection level, application-specific records generated from network traffic?
- Atransaction data
- Blocation data
- Cstatistical data
- Dalert data
61An engineer receives a security alert that traffic with a known TOR exit node has occured on the network. What is the impact of this traffic?
- Aransoware communicating after infection
- Busers downloading copyrighted content
- Cdata exfiltration
- Duser circumvention of the firewall
62What is an example of social engineering attacks?
- Areceiving an unexpected email from an unknown person with an attachment from someone in the same company
- Breceiving an email from human resources requesting a visit to their secure website to update contact information
- Csending a verbal request to an administrator who knows how to change an Account password
- Dreceiving an invitation to the department´s weekly Webex meeting
63Refer to te exhibit
Quadro contem e é : Interface 192.168.1.29 --- 0x11
What is occurring in this network?- AARP cache poisoning
- BDNS cache poiconing
- CMAC address table overflow
- DMAC flooding attack
64Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?
- Asyslog messages
- Bsyslog
- CNetFlow
- Dfirewall event logs
65Which action prevents buffer overflow attacks?
verificar !!!!!- AVariable randomization
- Busing web based applications
- Cinput sanitization
- Dusing a Linux operation system
66Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?
- Aknown-plaintext
- Breplay
- Cdictionary
- Dman-in-the-middle
67Refer exhibit
Quando que contem Internet Protocol version 4, Src: 192.168.122.100 Dst: 81.179.179.69- A81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol
- B192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol
- C192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol
- D81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using UDP protocol
68What are the two characteristics of the full packet captures? (Choose two)
- AIdentifying network loops and collision domains
- BTroubleshooting the cause of security and performance issues
- CReassembling fragmented traffic from raw data
- DDetecting common hardware faults and identify faulty assets
- EProviding a historical record of a network transaction
69Refer to the exhibit
Quadro com informações da CVE 2009-4324 PDF 2009 11 30 note 200911.pdf
An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file ?- AThe file has an embedded executable and was matched by PEID threat signatures for futher analysis
- BThe file has an embedded non-Windows executable but no suspicious features are identified
- CThe file has an embedded Windows 32 executable and the Yara field list suspicious features for futher analysis
- DThe file was matched by PEid threat signatures but no suspicious features are identified since the signature list ir up to date
70Drag and Drop the technology on the left onto the data type the technology provides on the right
- Atcpdump ---> Web contente filtering (session data)
- BWeb contente filtering ---> tcpdump (full packet capture)
- Ctraditional stateful firewall ---> NetFlow (transaction data)
- DNetflow ---> traditional stateful firewall (connection event)
71efer exhibit
Quadro wireshark
What is occurring in this network traffic?- AHigh rate of SYN packets being sent from a multiple source towards a single destination IP
- BHigh rate of ACK packets being sent from a single source IP towards multiple destination IPs
- CFlood of ACK packets coming from a single source IP to multiple destination IPs
- DFlood of SYN packets coming from a single source IP to a single destination IP.
72Na engineer needs to have visibility on TCP bandwidth usage, response time, and latency, combined with deep packet inspection to identify unknown software by its network traffic flow. Which two features of Cisco Appliacation Visibility and Control should the engineer use to accomplish this goal? (Choose two)
- Amanagement and reporting
- Btraffic filtering
- Cadaptive AVC
- Dmetrics collection and exporting
- Eapplication recognition
73Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?
- AHypertext transfer protocol
- BSSL certificate
- CTunneling
- DVpn
74An engineer is invetigatinga a case of the unauthorized usage of the "Tcpdump tool". The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?
- Atagged protocols being used on the network
- Ball firewall alerts and resulting mitigations
- Ctagged ports being used on the network
- Dall information and data within the datagram
75At a company party a guest asks questions about the company´s user Account - format and password complexyty. How is this type of conversaion classified?
- APhishing attack
- Bpassword revelation strategy
- CPiggybacking
- DSocial Engineering
76Which security monitoring data type requires the largest storage space?
- ATransaction data
- Bstatistical data
- Csession data
- Dfull packet capture
77 What are two denial of servisse attacks? (Choose two)
- AMITM
- BTCP connections
- Cping of death
- DUDP flooding
- Ecode rede
78An engineer needs to discover alive hosts withiin the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?
- Anmap --top-ports 192.168.1.0/24
- Bnmap --sP 192.168.1.0/24
- Cnmap -sL 192.168.1.0/24
- Dnmap -sV 192.168.1.0/24
79an analyst investigating a host in the network that appears to be communicating to a command and control server on the internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication
É um quadro que contem File Action Edit View Help
Which obfuscation technique is the attacker using?- ABase64 enconding
- BTLS encryption
- CSHA-256 hashing
- DROT13 encryption
80What are two diferences in how tampered and untampered disk images affect a security incidente? (Choose two)
- AUntampered images are used in the security investigation process
- BTampered images are used in the security investigation process
- CThe image is tampered if the stored hash and the computed hash match
- DTampered images are used in the incidente recovery process
- EThe image is untampered if the stored hash and the computer hash match
81During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?
- Aexamination
- Binvestigation
- Ccollection
- Dreporting
82Which step in the incidente response process researches an attacking host through logs in a SIEM?
- Adetection and analysis
- Bpreparation
- Ceradication
- Dcontainment
83A malicious file has been identified in a sandbox analysis tool
Quadro contendo File details
Which piece of information is needed to search for additional downloadas of this file by other hosts?- Afile header type
- Bfile size
- Cfile name
- Dfile hash value
84Refer to exhibit
Quadro dashboard Cisco Stealthwatch
What is the potential threat identified in this Stealthwatch dashboard?- AHost 10.201.3.149 is sending data to 152.46.6.91 using TCP/443
- BHost 152.48.6.91 is being identified as a watchlist country for data transfer
- CTraffic to 152.46.6.149 is being denied by an Advanced Network Control policy
- DHost 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91
85Refer to the exhibit
Quadro de stealthwatch:
What is the potential threat identified in this Stealthwatch dashboard- AA policy violation is active for host 10.10.101.24
- BA host on the network is sending a DDoS attack to another inside host
- CThere are two active data exfiltration alerts
- DA policy violation is active for host 10.201.3.149
86Which security technology allows only a set pre-approved applications to run on a system?
- Aapplication-level blacklisting
- Bhost-based IPS
- Capplication-level whitelisting
- Dantivirus
87An investigator is examining a copy of an ISO file that is stored in CDFS format. What type of evidence is this file?
- Adata from a CD copied using Mac-Based system
- Bdata from a CD copied using Linux system
- Cdata from a DVD copied using Windows system
- Ddata from a CD copied using Windows
88Which piece of information is needed for attibuition in an investigation ?
- Aproxy logs showing the source RFC 1918 IP Addresses
- BRDP allowed from the internet
- Cknown threat actor behavior
- D802.1x RADIUS authentication pass arid fail logs
89What does cyber attribution identify in an investigation?
- Acause of an attack
- Bexploit of an attack
- Cvulnerabilities exploited
- Dthreat actors of an attack
90A security engineer has a vídeo of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.
Which type of evidence is this?- Abest evidence
- Bprima facie evidence
- Cindirect evidence
- Dphysical evidence
91Refer a exhibit
$ cuckoo submit --machine cuckool /path/to/binary
Which event is occurring?- AA binary named "submit" is running on VM cuckoo1
- BA binary is being submitted to run on VM cuckoo1
- CA binary on VM cuckoo1 is being submitted for evaluation
- DA URL is being evaluated to see if it has a malicious binary
92Refer to the exhibit
Quadro com as informações - Mar 6 10:35:34 user sshd[12900]:pam_unix ...
in which Linux log file is this output found- A/var/log/authorization.log
- B/var/log/dmesg
- C/var/log/var.log
- D/var/log/auth.log
93An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection.
Which two pieces of information from the analysis report are needed to investigate the callouts? (Choose two)- Asignatures
- Bhost IP adresses
- Cfile size
- Ddropped files
- Edomain names
94An analyst is exploring the functionality of diferente operation systems.
What is a feature of Windows Management instrumentation that must be considered when deciding on an operating system?- Aan analyst is exploring the functionality of diferente operation systems.
What is a feature of Windows Management instrumentation that must be considered when deciding on an operating system? - Bdeploys Windows operating systems in an automated fashion
- Cis an eficiente tool for working with active directory
- Dhas a common information model, which describes installed hardware and software
- Aan analyst is exploring the functionality of diferente operation systems.
95What causes events on a Windows system to show Event code 4625 in the log messages?
- AThe system detected an XSS Attack
- BSomeone is trying a brute force attack on the network
- CAnother device is gaining root access to the system
- DA privilegied user successfully logged into the system
96Refer to the exhibit
Quadro que contém 10.44.101.23 -- [20/Nov/2017:14 ...]
What does the message indicate?- Aan access attempt was made from the Mosaic web browser
- Ba successful access attempt was made to retrieve the password file
- Ca successful access attempt was made to retrieve the root of the website
- Da denied access attempt was made to retrieve the password file
97Refer to the exhibit
GET /item.php?id=34' or sleep (10)
This request was sent to a web application server driven by a database. Which type of web server attack is represented?- Aparameter manipulation
- Bheap memory corruption
- Ccommand injection
- Dblind SQL injection
98A SOC analyst is investigating an incidente that involves a Linux System that is identifying specific sessions. Which identifier tracks an active program?
- Aapplication identification number
- Bactive process identification number
- Cruntime identification number
- Dprocess identification number
99An office audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise.
Which kind of evidence is this IP address?- Abest evidence
- Bcorroborative evidence
- Cindirect evidence
- Dforensic evidence
100Which system monitors local system operation and local network access for violations of a security policy?
- Ahost-based intrusion detection
- Bsystems-based sandboxing
- Chost-based firewall
- Dantivírus
101An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occured during the attack. What is the reason for this discrepancy?
- Athe computer has a HIPS installed on it
- Bthe computer has a NIPS installed on it
- Cthe computer has a HIDS installed on it
- DThe computer has a NIDS installed on it
102Refer to the exhibit
Quadro do Stealhwatch dashboard
What is the potential threat identified in this Stealthwatch dashboard?- AA policy violation is active for host 10.10.101.24
- BA host on the network is sending a DDoS attack to another inside host
- CThere are three active data exfiltration alerts
- DA policy violation is active for host 10.201.3.149
103What is a difference between tampered and untampered disk images ?
- AWhat is a difference between tampered and untampered disk images ?
- BUntampered images are deliberately altered to preserve as evidence
- CTampered images are used as evidence
- DUntampered images are used for forensic investigations
104What is a sandbox interprocess communication service ?
- AA collection of rules within the sandbox that prevent the communication between sandboxes
- BA collection of network services that are activated on an interface, allowing for inter-port communication
- CA collection of interfaces that allow for coordination of activities among processes
- DA collection of host services that allow for communication between sandboxes
105Which regular expression. matches "color" and "colour"?
- Acolo?ur
- Bcol[0-8]+our
- Ccolou?r
- Dcol[0-9]+our
106Which artifact is used to uniquely a detected file?
- Afile timestamp
- Bfile extension
- Cfile size
- Dfile hash
107A security engineer deploys an enterprise-wide host/endpoint technology for all of the company´s corporate PCs. Management requests the engineer to block a selected set of applications on all PCs.
Which technology should be used to accomplish this task?- Aappliaction whitelisting/blacklisting
- Bnetwork NGFW
- Chost-based IDS
- Dantivírus/antispyware software
108Which utility blocks a host portscan?
- AHIDS
- Bsandboxing
- Chost-based firewall
- Dantimalware
109Which evasion technique is indicated when an intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources?
- Aresource exhaustion
- Btunneling
- Ctraffic fragmentation
- Dtiming attack
110Refer to the exhibit
Quadro Coleta pcap
Which application protocol is in this PCAP file?- ASSH
- BTCP
- CTLS
- DHTTP
111Drag Drop
Quadro captura pcap- As
- Bss
112Refer to the exhibit
Quadro com informações SPRT SRVLOC SSCOP SSH SSL STANAG 5066 ...
What is the expected result when the "Allow subissector to reassemble TCP streams" feature is enabled?- Ainsert TCP subdissectors
- Bextract a file from a packet capture
- Cdisable TCP streams
- Dunfragment TCP
113Which type of data collection requires the largest amount of storage space?
- Aalert data
- Btransaction data
- Csession data
- Dfull packet capture
114Na analyst discovers that a legitimate seurity alert has benn dismisse. Which signature caused this impact on network traffic
- Atrue negative
- Bfalse negative
- Cfalse positive
- Dtrue positive
115Which signature impacts network traffic by causing legitimate traffic to be blocked
- Afalse negative
- Btrue positive
- Ctrue negative
- Dfalse positive
116Which two pieces of information are collected from the IPv4 protocol header? (Choose two)
- AUDP Port to which the traffic is destined
- BTCP Port from which the traffic wa sourced
- Csourced IP address of the packet
- Ddestination IP address of the packet
- EUDP Port from which the traffic is sourced
117Which HTTP header field is used in forensics to identify the type of browser used?
- Areferrer
- Bhost
- Cuser-agent
- Daccept-language
118Which event artifact is used to identify HTTP GET requests for a specific file?
- Adestination IP address
- BTCP ACK
- CHTTP status code
- DURI
119What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?
- ATapping interrogation replicates signals to a separate port for analyzing traffic
- BTapping interrogations detect and block malicious traffic
- CInline interrogation enables viewing a copy of traffic to ensure traffic is in compliance with security policies
- DInline interrogationn detects malicious traffic but does not block the traffic
120At which Layer is deep packet inspection investigated on a firewall?
- Ainternet
- Btransport
- Capplication
- Ddata link
121Drag and drop the access control models from the left onto the correct descriptions on the right
- AMAC > object owner determines permissions
- BABAC > OS determines permissions
- CRBAC > role of the subject determines permissions
- DDAC atributes of the subject determines permissions
122What is a difference between inline traffic interrogation and traffic mirroring?
- AInline inspection acts on the original traffic data flow
- BTraffic mirroring passes live traffic to a tool for blocking
- CTraffic mirroring inspects live traffic for analysis and mitigation
- DInline traffic copies packets for analysis and security
123A system administrator is ensuring that specific registry information is accurate.
Which type of configuration information does the HKEY_LOCAL_MACHINE hive contain?- Afile extension associations
- Bhardware, software, and securitiy settings for the system
- Ccurrently logged in users, including folders and control panel settings
- Dall users on the system, including visual settings
124Refer to exhibit.
Quadro wireshark
Which packet contains a file that is extractable within Wireshark?- A2317
- B1986
- C2318
- D2542
125 Which regex matches only on all lowercase letters?
- A[a-z]+
- B[^a-z]+
- Ca-z+
- Da*z-
126Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared? (Que ação deve ser tomada se o sistema ficar sobrecarregado com alertas quando falsos positivos e falsos negativos são comparados?)
- AModify the settings of the intrusion detection system
- BDesign criteria for reviewing alerts
- CRedefine signature rules
- DAdjust the alerts schedule
127What is the impact of false positive alerts on business compared to true positive? ***VERIFICAR RESPOSTA E DA QUESTÃO 164
- ATrue positives affect security as no alarm is raised when an attack has taken place, resulting in a potential breach.
- BTrue positive alerts are blocked by mistake as potential attacks affecting application avalability.
- CFalse positives affect security as no alarm is raised when an attack has taken place, resulting in a potential breach.
- DFalse positive alerts are blocked by mistake as potential attacks affecting application availability
128An engineer needs to fetch logs from a proxy server and generate actual events according to the data received. Which technology should the emgineer use to accomplish this task?
- AFirepower
- BEmail security appliance
- CWeb Security Appliance
- DStealthwatch
129Refer to the exhibit.
Quadro log de fw
Which technology generates this log?- ANetflow
- BIDS
- Cweb proxy
- Dfirewall
130Which filter allows an engineer to filter in Wireshark to futher analyze the PCAP file by only showing the traffic for LAN 10.11.X.X, between workstations and serves without the internet?
- Asrc=10.11.0.0/16 and dst=10.11.0.0/16
- Bip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16
- Cip.src==10.11.0.0/16 and ip.dst=10.11.0.0/16
- Dsrc==10.11.0.0/16 and dst=10.11.0.0/16
131Which tool provides a full packet capture from network traffic?
- ANagios
- BCAINE
- CHydra
- DWireshark
132A company is using several network applications that require high availability and responsiveness, such that miliseconds of latency on network traffic is not acceptable. Na engineer needs to analyze the network and indetify ways to improve traffic movement to minimize delas. Which information must the engineer obtain for this analysis?
- Atotal throughput on the interface of the router and NetFlow records
- Boutput of routing protocol authentication failures and ports used
- Crunnig processes on the applications and their total network usage
- Ddeep packet captures of each application flow and duration
133Refer to exhibit.
Quandro com root@:~#cat access-logs/access_130603.txt | ....
What is depicted in the exhibit?- AWindows Event logs
- BApache logs
- CIIS logs
- DUNIX-based syslog
134Which technology should be used to implemente a solution that makes routing decisions based on HTTP header, uniform resource identifier,and SSL session ID attributes?
- AAWS
- BIIS
- CLoad balancer
- DProxy server
135AN organization has recently adjusted its security stance in response to online threats made by a known hacktivist group.
What is the initial event called in the NIST SP800-61?- Aonline assault
- Bprecursor
- Ctrigger
- Dinstigator
136Which NIST IR category stakeholder is responsible for coordinating incidente response among various business units, minimizing damage, and reporting to regulatory agencies? (Qual parte interessada da categoria de RI do NIST é responsável por coordenar a resposta a incidentes entre as diversas unidades de negócios, minimizando os danos e reportando às agências reguladoras?)
- ACSIRT
- BPSIRT
- Cpublic affairs
- Dmanagement
137Which incidence response step includes identifying all hosts affected by an attack?
- Adetection and analysis
- Bpost-incident activity
- Cpreparation
- Dcontainment, eradication, and recovery
138Which two elements are used for profiling a network? (Choose two).(Quais são os dois elementos usados para criar o perfil de uma rede?)
- Asession duration
- Btotal throughtput
- Crunning processes
- Dlistening ports
- EOS fingerprint
139Which category relates to improper use or disclousure of PII data?
- Alegal
- Bcompliance
- Cregulated
- Dcontractual
140Which type of evidence supports a theory or an assumption that results from initial evidence? (Que tipo de evidência apoia uma teoria ou suposição resultante da evidência inicial?)
- Aprobabilistic
- Bindirect
- Cbest
- Dcorroborative
141Which two elements are assests in the role of attribution in an investigation? (Choose two) (
Quais são os dois elementos que são ativos na função de atribuição em uma investigação? (Escolha dois))- Acontext
- Bsession
- Claptop
- Dfirewall log
- Ethreat actor
142What is personally identifiable information that must be safeguarded from unauthorized access?
- Adate of birth
- Bdriver's license number
- Cgender
- Dzip code
143in SOC environment, what is a vulnerability management metric?
- Acode signing enforcement
- Bfull assest scan
- Cinternet exposed devices
- Dsingle factor authentication
144WhiLe viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header.
Which technology makes this behavior possible? era 126- Aencapsulation
- BTOR
- Ctunneling
- Dnat
145A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file? **********
- ACD data copy prepared in Windows
- BCD data copy prepared in Mac--based system
- CCD data copy prepared in Linux system
- DCD data copy prepared in Android-based system
146Which two elements of the incidente response process are stated in NIST Special Publication 800-61 r2? (Choose two)
- Adetection and analysis
- Bpost-incidente activity
- Cvulnerability management
- Drisk assessment
- Evulnerability scoring
147Drag and Drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.
- AThe threat actor takes actions to violate data integrity and availability >>>> exploitation
- BThe targeted environment is taken advantage of triggering the threat actor´s code >>>> Instalation
- CBackdoor is placed on the victim system allowing the threat actor to maintain the persistence >>>> Command and Control
- Dan outbound connection is established to an internet-based controller server >>>> Actions an Objectives
148Refer to the exhibit.
Quadro de uma saída nmap
What does this output indicate?- AHTTPS ports are open on the server
- BSMB ports are closed on the server
- CFTP ports are open on the server
- DEmail ports are closed on the server
149Drag and Drop the elements from the left into the correct order for incidente handling on the right
- Apreparation >>> create communication guidelines for effective incidente handling
- Bcontainment, erradication and recovery >>> gather indicators of compromisse and restore the system
- Cpost-incidente analysis >>> document information to mitigate similar occrurrences
- Ddetection and analysis >>> collect data from systems for futher investigation
150Which metric should be used when evaluation the effectiveness and scope of a Security Operations Center? (Qual métrica deve ser usada ao avaliar a eficácia e o escopo de um Centro de Operações de Segurança?)
- AThe average time the SOC takes to register and assign the incidente
- BThe total incidente escalations per week
- CThe average time the SOC takes to detect and resolve the indicent
- DThe total incident escalations per month
151A delevoper is working on a project using a Linux tool that enables writing processes to obtain these required results:
Which component results from this operation?- Aparent directory name of a file pathname
- Bprocess spawn scheduled
- Cmacros for managing CPU sets
- Dnew process created by parent process
152An engineer discovered a breach, identified and threat's entry point, and removed access. The engineer was able to identify the host, the IP address of the threat actor, and the application the threat actor targeted. What is the nexte step the engineer should take according to the NIST SP 800-61 Incident handling guide?
- ARecover from the threat
- BAnalyze the threat
- CIdentify lessons learned from the threat
- DReduce the probability of similar threats
153Refer to the exhibit.
Quadro Janela Wireshark
What is shown in this PCAP file?- ATimestamps are indicated with error
- Bthe protocol is TCP
- CThe User-Agent is Mozilla/5.0
- DThe HTTP GET is encoded
154What is a difference between tampered and untampered disk images **** ERRADA NO DUMP
- ATampered images have the same stored and computed hash
- BTampered images are used as evidence
- CUntampered images are used for forensic investigations
- DUntampered images deliberately altered to preserve as evidence
155the SOC team has confirme a potential indicator of compromisse on an endpoint. The team has narrowed the executable file's type to a new trojan Family. According to the NIST computer Security Incident Handling Guide, What is the next step in handling this event?
- AIsolate the infected endpoint from the network
- BPerform forensics analysis on the infected endpoint
- CCollec public information on the malware behavior
- DPrioritize incidente handling based on the impact
156Which technology on a host is used to isolate a running application from other applications?
- Asandbox
- Bapplication allow list
- Capplication block list
- Dhost-based firewall
157AN analyst received a ticket regarding a degraded processing capability for one of the HR department´s servers. On the same day, an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, What is the next phase of this investigation?
- ARecovery
- BDetection
- CEradication
- DAnalysis
158 Which data type is necessary to get information about source/destination ports?
- Astatistical data
- Bsession data
- Cconnectivity data
- Dalert data
159Refer to the exhibit.
SELECT * FROM people WHERE username ="OR '1'='1';
Which type of attack is being executed?- ASQL injection
- Bcross-site scripting
- Ccross-site request forgery
- Dcommand injection
160Which attack represents the evasion technique of resource exhaustion?
- ASQL Injection
- Bman-in-the-middle
- Cbluesnarfing
- Ddenial-of-service
161A Threat actor penetrated an organization´s network. Using the 5-Tuple approach. Which data points should the analyst use to isolate the compromised host in a grouped set of logs?
- Aevent name, log source, time, source IP, and host name
- Bprotocol, source IP, source port, destination IP, and destination port
- Cevent name, log source, time, source IP, and username
- Dprotocol, log source, source IP, destination IP, and host name
162Which event is a vishing attack? (Qual evento é um ataque vishing?
- Aobtaining disposed documnts from an organization
- Busing a vulnerability scanner on a corporate network
- Csetting up a rogue access point near a public hotspot
- Dimpersonating a tech Support agent during a phone call
163What is indicated by an increase in IPv4 traffic carrying protocol 41
- Aadditional PPTP traffic due to Windows clients
- Bunathorized peer-to-peer traffic
- Cdeployment of a GRE network on top of an existing layer 3 network
- Dattempts to tunnel IPv6 traffic throught an IPv4 network
164What is the impact of false positive alerts on business compared to true positive?
- ATrue positives affect security as no alarm is raised when an attack has taken place, while falase positives are alerts raised appropriately to detect and futher mitigate them.
- BTrue-positive alerts are blocked by mistake as potential attacks, while false-positives are actual attacks indentified as harmless
- CFalse-positive alert are detecetd by confunsion as potential attacks, while true positives are attack attempts identified appropriately
- DFalse positives alerts are amnually ignored signatures to avoid warnings that are already acknowledge, while true positives are warnings that are note yet acknowledged
165 An organization's security team has detected network spikes coming from the internal network. An investigation has concluded that the spike in traffic was intensive network scanning how should the analyst collect the traffic to isolate the suspicious host?
- Aby most active source IP
- Bby most used ports
- Cbased on the protocols used
- Dbased on the most used applications
166What is an incident response plan? (O que é um plano de resposta de incidente?
- Aan organizational approach to events that could lead to asset loss or disruption of operations
- Ban organizational approach to security management to ensure a service lifecycle and continuous improvements
- Can organizational approach to disaster recovery and timely restoration of operational services
- Dan organizational approach to system backup and data archiving aligned to regulations
167An engineer is addressing a connectivity issue between two servers where the remote server is unable to establish a successful session. Initial checks show that the remote server is not receiving an SYN-ACK while establishing a session by sending the first SYN. What is causing this issue ?
- Aincorrect TCP handshake
- Bincorrect UDP handshake
- Cincorrect OSI configuration
- Dincorrect snaplen configuration
168A Security incidente occured with the potential of impacting business services. Who performs tha attack ?
- Amalware author
- Bthreat actor
- Cbug bounty Hunter
- Ddirect compeitor
169Refer to the exhibit.
Quadro log ASA
AN analyst received this alert from the Cisco ASA device,and numerous activity logs were produced. How should this type of evidence be categorized?- Aindirect
- Bcircunstantial
- Ccorroborative
- Dbest
170What is vulnerability management?
- AA security practice focused on clarifying and narrowing intrusion poinnts
- BA security practice of performing actions rather than acknowledging
- CA process to identify and remediate existing weaknesses
- DA process to recover from service interruptions and restore business-critical applications
171A user an email attachment named "Hr405-report2609-empl094.exe" but did not run it. Which category of the cyber kill chain should be assigned to this type of event?
- Ainstallation
- Breconnaissance
- Cweaponization
- Ddelivery
172An engineer needs to configure network systems to detect command and control communictations by decrypting ingress and egress perimeter traffic and allowing network security devices to detect malicious outbound communications. Which technology should be used to accomplish the task?
- Adigital certificates
- Bstatic IP addresses
- Csignatures
- Dcipher suite
173What is a difference between data obtained from Tap and SPAN ports?
- Atap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.
- BSPAN passively splits traffic between a network device and the network without altering it. While Tap alters response times
- CSPAN improves the detection of media errors, while Tap provides direct access to traffic with with lowered data visibility
- DTap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination
174Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?
- Aavailability
- Bconfidentiality
- Cscope
- Dintegrity
175Refer exhibit.
Quadro com informacoes 192.168.10.10 -- ... GET /icons/powerred ...
What is occurring within the exhibit?- Aregular GET request
- BXML External Entities attack
- Cinsecure deserialization
- Dcross-site scripting attack
176Refer to the exhibit
Quadro com HKEY_LOCAL_MAHINE
Which componente is identifiable in this exhibit ?- ATrusted Root Certificate store on the local machinee
- BWindows PowerShell verb
- CWindows Registry hive
- DLocal service in the Windows Services Manager
177aN engineer received an alert affecting the degraded performance of a critical server. Analysis showed a heavy CPU and memory load. What is the next step the engineer should take to investigate this resource usage?
- ARun "ps -d" to decrease the priority state of high load processes to avoid resource exhaustion
- BRun "ps -u" to find out who executed additional processes that caused a high load on a server
- CRun "ps -ef" to understand which processes are taking a high amount of resources
- DRun "ps -m" to capture the existing state of daemons and required processes to find the gap
178What is difference between an inline and a tap mode traffic monitoring?
- Ainline monitors traffic without examining other devices, while a tap mode tags traffic and examines the data from monitoring devices
- BTap mode monitors traffic Direction, while inline mode keeps packet data as it passes through the monitoring devices
- CTap mode monitors packets and their contente with the highest seep. While the inline mode draws packet path for analysis.
- DInline mode monitors traffic path, examining any traffic ate a wire speed, while a tap mode monitors trafica as it crosses the network
179Drag and drop the event term from the left onto the description on the right
- ATrue negative >>>>> malicious traffic is identified nd an alert ir generated
- Bfalse negative >>>> benign traffic incorrectly generates an alert
- Ctrue positive >>>> benign traffic does not generate an alert
- Dfalse positive >>> malicious traffic does not generate an alert
180Drag and Drop the definitio from the left onto the phase on the right to classify intruion events according to the Cyber Kill Chain model
- AThe threat actor engages in identification and selection of targets >>> reconnaissance
- BNa exploit is coupled with a remote access trojan >>> weaponization
- CThe weapon is tranferred to the target environment >>>> delivery
181Which regular expression. is needed to capture the IP address 192.168.20.232
- A^(?:[0-9]{1,3}\.){3}[0-9]{1,3}
- B^(?:[0-9]{1,3}\.){1,4}
- C^(?:[0-9]{1,3}\.)'
- D^([0-9]-{1,3})
182How does a certificate authority impact security? (Como uma autoridade certificadora afeta a segurança?)
- Ait validates cliente identity when communicating with the server
- Bit authenticates cliente identity when requesting an SSL certificate
- Cit authenticates domain identity when requesting an SSL certificate
- Dit validates the domain identity of the SSL certificate
183What is a difference between SOAR and SIEM (Qual é a diferença entre SOAR e SIEM)
- ASOAR predicts and prevents security alerts, while SIEM checks attack pattern and applies the mitigation
- BSIEM´s primary function is to collect and detect anomalles, while SOAR is more focused on security operations automation and response --correta
- CSIEM predicts and prevnts security alerts, while SOAR check attack patterns and applies the mitigation
- DSOAR´s primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response
184What is a difference between signature-based and behavior-based detection?
- ASignature-based identifies behaviors that may linked to attacks, while behavior-based has a predefined set of rules to match before an alert
- BBehavior-based identifies behaviors that may be liked to attacks. While signature-based has a predefined set of rules to match before an alert
- CBehavior-based uses a known vulnerability database, while signature-based intelligently summarizes existing data
- DSignature-based uses a known vulnerability database, while behavior-based intelligently summarizes existing data
185Refer to the exhibit
Quadro com informações Time format: local ... Fields date, time, action, protocol, src-ip ...
An engineer received an event log file to review. Which technology generated the log?- ANetflow
- Bproxy
- Cfirewall
- DIDS/IPS
186What is the difference between inline traffic interrogation and traffic mirroring?
- AInline interrogation is less complex as traffic mirroring applies additional tags to data
(A interrogação in-line é menos complexa, pois o espelhamento de tráfego aplica tags adicionais aos dados) - BTraffic mirroring coples the traffic rather than forwarding it directly to the analysis tools
- CInline replicates the traffic to preserve integrity rather than modifying packets before sending them to other analysis tools
- DTraffic mirroring results in faster traffic analysis and inline ir considerably slower due to latency
- AInline interrogation is less complex as traffic mirroring applies additional tags to data
187Refer to the exhibit
Quadro que contem informacao de certificado digital
A company employee is connecting to mail google.com from an endpoint device. The website is loaded but with an error. What is occurring?- ADNS hijacking attack
- BEndpoint local time is invalid
- CCertificate is not in trusted roots
- Dman-in-the-middle attack
188Na analyst is using the SIEM plataform and must extract a custom property from a Cisco device and capture the frase, "File: Clean." Which regex must the analyst import?
- AFile: Clean
- B^Parent File Clean$
- CFile: Clean (.*)
- D^File: Clean$
189What describes the concept of data consistently and readly accessible for legitimate users?
(O que descreve o conceito de dados de forma consistente e facilmente acessível para usuários legítimos?)- Aintegrity
- Bavailability
- Caccessibility
- Dconfidentiality
190Refer to the exhibit
Which frame numbers contain a file that is extractable via TCP stream within Wireshark- A7,14 and 21
- B7 and 21
- C14,16,18 and 19
- D7 to 21
191Refer to the exhibit
Quadro com nomes de trabalhadores e regras
Which stakeholders must be involved when a company workstation is compromised?- AEmployee 1, Employee 2, Employee 3, Employee 4, Employee 5, Employee 7
- BEmployee 1, Employee 2, Employee 4, Employee 5
- CEmployee 4, Employee 6, Employee 7
- DEmployee 2, Employee 3, Employee 4, Employee 5
192How does an attack surface differ from an attack vector?
- AAN attack vector recognizes the potential outcomes of an attack, and the attack surface is choosing a method of an attack
- BAN attack surface identifies vulnerable parts for an attack, and attack vector specifies which attacks are feasible to those parts
- CAN attack surface mitigates external vulnerabilities, and an attack vector identifies mitigation techniques and possible workarounds
- DAN attack vector matches componentes that can be exploited, and an attack surface classifies the potential path for exploitation
193A secutity analyst notices a sudden surge of incoming traffic and detects unknown packets from unknown senders After further investigation, the analyst learns that customers claim that they cannot access
company servers According to NIST SP800-61, in which phase of the incident response process is the analyst?- Apost-incidente activity
- Bdetection and analysis
- Cpreparation
- Dcontainment, eradication, and recovery
194Which vulnerability type is used to read, write, or erase information from a database?
- Across-site scripting
- Bcross-site request forgery
- Cbuffer overflow
- DSQL injection
195AN automotive company provides new types of engines and special brakes for a rally sports cars. The company has a database of inventions and patentes for their engines and technical information Customers can access
the database through the company´s website after they register and identify themselves. Which type of protected data is accessed by customers?- AIP data
- BPII data
- CPSI data
- DPHI data
196According to the September 2020 threat intelligence feeds a new malware called Egregor was introduced and used many attacks. Distribuition of Egregor is pnmanly through a Cobalt Strike that has been installed on victim´s workstations using RDP exploits Malware exfiltrates the victim´s data to a command and control server. The data is used to force victims pay or lose it by publicly releasing it. Which type of attack is described?
- Amalware attack
- Bransomware attack
- Cwhale-phishing
- Dinsider threat
197Syslog collecting software is installed on the server for the log containment, a disk with FAT type partition is used An engineer determined that log files are being corrupted when the 4GB tile size is exceeded.
- AAdd space to the existing partition and lower the retention period.
- BUse FAT32 to exceed the limit of 4GB
- CUse the EXT4 partition because it can hold files up to 16TB
- DUse NTFS partition for log file containment
198What are two categories of DDoS attacks? (Choose two)
- Asplit brain
- Bscanning
- Cphishing
- Dreflected --reflected
- Edirect --direct
199What is an advantage of symmetric over asymmetric encryption?
- AA key is generated on demand according to data type
- BA one-time encryption key is generated for data transmission
- CIt is suited for transmitting large amounts of data
- DIt is a faster encryption mechanism for sessions
200What are two denial-of-service (DoS) attacks? (Choose two)
- Aport scan
- BSYN flood
- Cman-in-the-middle
- Dphishing
- Eteardrop
Information
- Description
- Quiz on Untitled, created by Imperio Medicinal on 19/08/2024.
- Author
- Imperio Medicinal
- Language
- Português
- Views
- 8
- Tags
- Rating
- No ratings yet Rate this quiz