Test002

An analyst is investigating an incident in a SOC environment.

Which method is used to identify a session from a group of logs?

• sequence numbers

• IP identifier

• 5-tuple

• timestamps

Which attack method intercepts traffic on a switched network?

• denial of service

• ARP cache poisoning

• DHCP snooping

• command and control

What does an attacker use to determine which network ports are listening on a potential target device?

• man-in-the-middle

• port scanning

• SQL injection

• ping sweep

How does a certificate authority impact security?

• It authenticates domain identity when requesting an SSL certificate.

• It validates client identity when communicating with the server.

• It authenticates client identity when requesting an SSL certificate.

• It validates the domain identity of the SSL certificate.

Which data type is necessary to get information about source/destination ports?

• statistical data

• session data

• alert data

• connectivity data

Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?

• known-plaintext

• replay

• dictionary

• man-in-the-middle

How does an SSL certificate impact security between the client and the server?

• by enabling an authenticated channel between the client and the server

• by creating an integrated channel between the client and the server

• by enabling an authorized channel between the client and the server

• by creating an encrypted channel between the client and the server

What makes HTTPS traffic difficult to monitor?

• SSL interception

• packet header size

• signature detection time

• encryption

How does an attacker observe network traffic exchanged between two users?

• port scanning

• man-in-the-middle

• command injection

• denial of service

An engineer is investigating a case of the unauthorized usage of the `Tcpdump` tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?

• tagged protocols being used on the network

• all firewall alerts and resulting mitigations

• tagged ports being used on the network

• all information and data within the datagram