Q83. The statement of applicability (SOA) document forms a fundamental part of which framework?

Q84. A security administrator is investigating a compromised host. Which of the following commands could the investigator use to display executing processes in real time?

Q85. A security analyst needs to capture network traffic from a compromised Mac host. They attempt to execute the tcpdump command using their general user account but continually receive an “Operation Not Permitted” error.
Use of which of the following commands will allow the analyst to capture traffic using tcpdump successfully?

Q86. Which answer option is a tactic of social engineering in which an attacker engages in an attack performed by phone?

Q87. A secretary receives an email from a friend with a picture of a kitten in it. The secretary forwards it to the
~COMPANYWIDE mailing list and, shortly thereafter, users across the company receive the following message:
“You seem tense. Take a deep breath and relax!”
The incident response team is activated and opens the picture in a virtual machine to test it. After a short analysis, the following code is found in C:
Tempchill.exe:Powershell.exe -Command “do {(for /L %i in (2,1,254) do shutdown /r /m Error! Hyperlink reference not valid.> /f /t / 0 (/c “You seem tense. Take a deep breath and relax!”);Start-Sleep -s 900) } while(1)” Which of the following BEST represents what the attacker was trying to accomplish?

Q88. Which of the following are legally compliant forensics applications that will detect an alternative data stream (ADS) or a file with an incorrect file extension? (Choose two.)

Q89. A first responder notices a file with a large amount of clipboard information stored in it. Which part of the MITRE ATT&CK matrix has the responder discovered?

Q90. During which of the following attack phases might a request sent to port 1433 over a whole company network be seen within a log?

Q91. Which of the following is the GREATEST risk of having security information and event management (SIEM) collect computer names with older log entries?

Q92. An incident handler is assigned to initiate an incident response for a complex network that has been affected by malware. Which of the following actions should be taken FIRST?

Q93. Windows Server 2016 log files can be found in which of the following locations?

Q94. After a hacker obtained a shell on a Linux box, the hacker then sends the exfiltrated data via Domain Name System (DNS). This is an example of which type of data exfiltration?

Q95. When performing a vulnerability assessment from outside the perimeter, which of the following network devices is MOST likely to skew the scan results?

Q96. Which of the following technologies would reduce the risk of a successful SQL injection attack?

Q97. Which of the following is an essential component of a disaster recovery plan?

Q98. An incident at a government agency has occurred and the following actions were taken:
– Users have regained access to email accounts
– Temporary VPN services have been removed
– Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated
– Temporary email servers have been decommissioned
Which of the following phases of the incident response process match the actions taken?

Q99. A company has noticed a trend of attackers gaining access to corporate mailboxes. Which of the following would be the BEST action to take to plan for this kind of attack in the future?

Q100. Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)

Q101. A Windows system administrator has received notification from a security analyst regarding new malware that executes under the process name of “armageddon.exe” along with a request to audit all department workstations for its presence. In the absence of GUI-based tools, what command could the administrator execute to complete this task?

Q102. Which of the following tools can be used as an intrusion detection system (IDS)? (Choose three.)

Q103. Which of the following are components of Security Content Automation Protocol (SCAP)?

Q104. According to Payment Card Industry Data Security Standard (PCI DSS) compliance requirements, an organization must retain logs for what length of time?