SPQ5

A SOC is currently being outsourced. Which of the following is being used?

• Microservices

• SaaS

• MSSP

• PaaS

A security analyst is investigating a phishing email that contains a malicious document directed to the company's Chief Executive Officer (CEO). Which of the following should the analyst perform to understand the threat and retrieve possible IoCs?

• Run a vulnerability scan against the CEOs computer to find possible vulnerabilities

• Install a sandbox to run the malicious payload in a safe environment

• Perform a traceroute to identify the communication path

• Use netstat to check whether communication has been made with a remote host

Which of the following controls would BEST identify and report malicious insider activities?

• An intrusion detection system

• A proxy

• Audit trails

• Strong authentication

A user's PC was recently infected by malware. The user has a legacy printer without vendor support, and the user's OS is fully patched. The user downloaded a driver package from the internet. No threats were found on the downloaded file, but during file installation, a malicious runtime threat was detected. Which of the following is MOST likely cause of the infection?

• The driver has malware installed and was refactored upon download to avoid detection.

• The user's computer has a rootkit installed that has avoided detection until the new driver overwrote key files.

• The user's antivirus software definition were out of date and were damaged by the installation of the driver

• The user's computer has been infected with a logic bomb set to run when new driver was installed.

A company's cybersecurity department is looking for a new solution to maintain high availability. Which of the following can be utilized to build a solution? (Select Two)

• A stateful inspection

• IP hashes

• A round robin

• A VLAN

• A DMZ

A network analyst is investigating compromised corporate information. The analyst leads to a theory that network traffic was intercepted before being transmitted to the internet. The following output was captured on an internal host. (See attached image)

Based on the IoCS, which of the following was the MOST likely attack used to compromise the network communication?

• Denial of service

• ARP poisoning

• Command injection

• MAC flooding

Users reported several suspicious activities within the last two weeks that resulted in several unauthorized transactions. Upon investigation, the security analyst found the following. (See attached image) Multiple reports of breached credentials within that time period Traffic being redirected in certain parts of the network Fraudulent emails being sent by various internal users without their consent Which of the following types of attacks was MOST likely used?

• Replay attack

• Race condition

• Cross site scripting

• Request forgeries

Which of the following BEST describes the method a security analyst would use to confirm a file that is downloaded from a trusted security website is not altered in transit or corrupted using a verified checksum?

• Hashing

• Salting

• Integrity

• Digital signature

A new security engineer has started hardening systems. One of the hardening techniques the engineer is using involves disabling remote logins to the NAS. Users are now reporting the inability to use SCP to transfer files to the NAS, even though the data is still viewable from the users PCs. Which of the following isthe MOST likely cause of this issue?

• TFTP was disabled on the local hosts

• SSH was turned off instead of modifying the configuration file

• Remote login was disabled in the networkd.config instead of using the sshd.conf

• Network services are no longer running on the NAS

A company wantsto deploy systems alongside production systems in order to entice threat actors and to learn more about attackers. Which of the following BEST describe these systems?

• DNS sinkholes

• Honeypots

• Virtual machines

• Neural network