A digital forensics investigation requires analysis of a compromised system's physical memory. Which of the following tools should the forensics analyst use to complete this task?
What is the primary role of an intrusion detection system (IDS) on a network?
A forensic analyst has been tasked with analyzing disk images with file extensions such as .001, .002, etc. Which of the following disk imaging tools was MOST LIKELY used to create these image files?
A company help desk is flooded with calls regarding systems experiencing slow performance and certain Internet sites taking a long time to load or not loading at all. The security operations center (SOC) analysts who receive these calls take the following actions:
-Running antivirus scans on the affected user machines
-Checking department membership of affected users
-Checking the host-based intrusion prevention system (HIPS) console for affected user machine alerts
-Checking network monitoring tools for anomalous activities
Which of the following phases of the incident response process match the actions taken?
Which of the following is the BEST way to prevent social engineering attacks?
A system administrator identifies unusual network traffic from outside the local network. Which of the following
is the BEST method for mitigating the threat?
Which standard was implemented in the United States to protect the privacy of patient medical information through restricted access to medical records and regulations for sharing medical records?
Which of the following is an automated password cracking technique that uses a combination of uppercase and lowercase letters, 0-9 numbers, and special characters?
Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)
A government organization responsible for critical infrastructure is being attacked and files on the server been deleted. Which of the following are the most immediate communications that should be made regarding the incident? (Choose two.)
A Windows system administrator has received notification from a security analyst regarding new malware that executes under the process name of “armageddon.exe” along with a request to audit all department workstations for its presence. In the absence of GUI-based tools, what command could the administrator execute to complete this task?
Network infrastructure has been scanned and the identified issues have been remediated. What is the next step in the vulnerability assessment process?
A first responder notices a file with a large amount of clipboard information stored in it. Which part of the MITRE ATT&CK matrix has the responder discovered?
What is the definition of a security breach?
Malicious code designed to execute in concurrence with a particular event is BEST defined as which of the following?
Which of the following digital forensic goals is being provided with hashing and time-stamping of the electronic evidence?
Recently, a cybersecurity research lab discovered that there is a hacking group focused on hacking into the computers of financial executives in Company A to sell the exfiltrated information to Company B. Which of the
following threat motives does this MOST likely represent?
When reviewing log files from a recent incident, the response team discovers that most of the network-based indicators are IP-based. It would be helpful to the response team if they could resolve those IP-based indicators to hostnames. Which of the following is BEST suited for this task?
Which term describes the process of collecting logs from many sources across an IT infrastructure into a single, centralized platform to be reviewed and analyzed?
Which of the following would MOST likely make a Windows workstation on a corporate network vulnerable to remote exploitation?
During recovery from an incident, which three options should a company focus on? (Choose three.)
What is the correct order of the DFIR phases?
Which of the following is an essential component of a disaster recovery plan?
Which of the following regulations is most applicable to a public utility provider operating in the United States?
The NIST framework 800-137 breaks down the concept of continuous monitoring into which system of tiers?
A cybersecurity expert assigned to be the IT manager of a middle-sized company discovers that there is little endpoint security implementation on the company’s systems. Which of the following could be included in an endpoint security solution? (Choose two.)
In which of the following attack phases would an attacker use Shodan?
Which three of the following are included in encryption architecture? (Choose three.)
What describes the BEST approach for developing a plan to continuously assess and track vulnerabilities on all organizational assets and infrastructure in order to remediate and minimize the opportunity for attacks?
Which of the following backup strategies will result in the shortest backup time during weekdays and use the least amount of storage space but incur the longest restore time?
Which two options represent the most basic methods for designing a DMZ network firewall? (Choose two.)
What is the primary purpose of the "information security incident triage and processing function" in the (CSIRT) Computer Security Incident Response Team Services Framework?
During which of the following attack phases might a request sent to port 1433 over a whole company network be seen within a log?
Which encryption technology was built into Mac OS X?
An administrator investigating intermittent network communication problems has identified an excessive amount of traffic from an external-facing host to an unknown location on the Internet. Which of the following
BEST describes what is occurring?
Traditional SIEM systems provide:
A security administrator notices a process running on their local workstation called SvrsScEsdKexzCv.exe.
The unknown process is MOST likely:
Windows Server 2016 log files can be found in which of the following locations?
Which of the following types of digital evidence is considered the MOST volatile?
How does encryption work to protect information on remote workers' computers?
During the forensic analysis of a compromised computer image, the investigator found that critical files are missing, caches have been cleared, and the history and event log files are empty. According to this scenario, which of the following techniques is the suspect using?
According to SANS, when should an incident retrospective be performed?
During a log review, an incident responder is attempting to process the proxy server’s log files but finds that
they are too large to be opened by any file viewer. Which of the following is the MOST appropriate technique to open and analyze these log files?
Which of the following, when exposed together, constitutes PII? (Choose two.)
Which of the following can increase an attack surface?
Which of the following is considered a weakness or gap in a security program that can be exploited to gain unauthorized access?
Which of the following does the command nmap –open 10.10.10.3 do?
Which asset would be the MOST desirable for a financially motivated attacker to obtain from a health insurance company?
Which of the following is susceptible to a cache poisoning attack?
A security operations center (SOC) analyst observed an unusually high number of login failures on a particular database server. The analyst wants to gather supporting evidence before escalating the observation to management. Which of the following expressions will provide login failure data for 11/24/2015?
What is the BEST process to identify the vendors that will ensure protection and compliance with security and privacy laws?
A Linux system administrator found suspicious activity on host IP 192.168.10.121. This host is also establishing a connection to IP 88.143.12.123. Which of the following commands should the administrator use to capture only the traffic between the two hosts?
After a security breach, a security consultant is hired to perform a vulnerability assessment for a company’s web application. Which of the following tools would the consultant use?
Nmap is a tool most commonly used to:
