Quiz CSA (Final)

What code HTTPS Status for server cannot handle the request?

• 4xx

• 1xx

• 2xx

• 5xx

What does HTTPS Status code 403 represents?

• Forbidden Error

• Unauthorized Error

• Not Found Error

• Internal Server Error

John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is coming. Which of the following data source will he use to prepare the dashboard?

• Apache/ Web Server logs with IP addresses and Host Name

• DHCP/Logs capable of maintaining IP addresses or hostnames with IPtoName resolution

• IIS/ Web Server logs with IP addresses and user agent IPtouseragent resolution.

• DNS/ Web Server logs with IP addresses

David is a SOC analyst in Karen Tech. One day an attack is initiated by the intruders but David was not able to find any suspicious events. This type of incident is categorized into?

• False positive Incidents

• False Negative Incidents

• True Positive Incidents

• True Negative Incidents

An organization is implementing and deploying the SIEM with following capabilities. What kind of SIEM deployment architecture the organization is planning to implement?

• Cloud, MSSP Managed

• Self-hosted, MSSP Managed

• Self-hosted, Self-Managed

• Self-hosted, Jointly Managed

Identify the attack in which the attacker exploits a target system through publicly known but still unpatched vulnerabilities.

• DNS Poisoning Attack

• Slow DoS Attack

• DHCP Starvation

• Zero-Day Attack

Which of the following can help you eliminate the burden of investigating false positives?

• Not trusting the security devices

• Ingesting the context data

• Treating every alert as high level

• Treating every alert as high leve

Which of the following is a Threat Intelligence Platform?

• TC Complete

• Keepnote

• SolarWinds MS

• Apility.io

Which of the following is a report writing tool that will help incident handlers to generate efficient reports on detected incidents during incident response process?

• threat_note

• MagicTree

• IntelMQ

• Malstrom

Which of the following technique involves scanning the headers of IP packets leaving a network to make sure that the unauthorized or malicious traffic never leaves the internal network?

• Ingress Filtering

• Egress Filtering

• Throttling

• Rate Limiting