Cyber Quiz

What is a sandbox interprocess communication service?

• A collection of host services that allow for communication between sandboxes

• A collection of interfaces that allow for coordination of activities among processes

• A collection of network services that are activated on an interface, allowing for inter-port communication.

• A collection of rules within the sandbox that prevent the communication between sandboxes

What causes events on a Windows system to show Event Code 4625 in the log messages?

• Someone is trying a brute force attack on the network

• Another device is gaining root access to the system

• The system detected an XSS attack

• A privileged user successfully logged into the system

Which type of data consists of connection level, application-specific records generated from network traffic?

• statistical data

• alert data

• location data

• transaction data

How is NetFlow different from traffic mirroring?

• NetFlow generates more data than traffic mirroring

• NetFlow collects metadata and traffic mirroring clones data

• Traffic mirroring costs less to operate than NetFlow

• Traffic mirroring impacts switch performance and NetFlow does no

An analyst discovers that a legitimate security alert has been dismissed.Which signature caused this impact on the network traffic?

• true negative

• true positive

• false negative

• false positive

What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in thenetwork?

•  

  Inline interrogation enables viewing a copy of traffic to ensure traffic is in compliance with security policies

• Tapping interrogation replicates signals to a separate port for analyzing traffic

• Inline interrogation detects malicious traffic but does not block the traffic

• Tapping interrogations detect and block malicious traffic

Which signature impacts network traffic by causing legitimate traffic to be blocked?

• true negative

• false negative

• false positive

• true positive

Which two elements are assets in the role of attribution in an investigation? (Choose two.)

• context

• firewall logs

• laptop

• threat actor

• session

An engineer discovered a breach, identified the threats entry point, and removed access. The engineer was able to identify the host, the IPaddress of the threat actor, and the application the threat actor targeted. What is the next step the engineer should take according to the NIST SP800-61 Incident handling guide?

• Analyze the threat

• Reduce the probability of similar threats

• Recover from the threat

•  

  Identify lessons learned from the threat

Which incidence response step includes identifying all hosts affected by an attack?

• preparation

• containment, eradication, and recovery

•  

  detection and analysis

• post-incident activity