SYO 701 EDR Module FC

60. A recent malware outbreak across a subnet included successful rootkit installations on many PCs, ensuring persistence by rendering remediation efforts ineffective. Which of the following would best detect the presence of a rootkit in the future?

• A. FDE

• B. NIDS

• C. EDR

• D. DLP

170. A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee's corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?

• A. Application

• B. IPS/IDS

• C. Network

• D. Endpoint

392. A new vulnerability enables a type of malware that allows the unauthorized movement of data from a system. Which of the following would detect this behavior?

• A . Implementing encryption

• B . Monitoring outbound traffic

• C . Using default settings

• D . Closing all open ports

360. A security administrator recently reset local passwords and the following values were recorded in the system:

Which of the following in the security administrator most likely protecting against?

• A . Account sharing

• B . Weak password complexity

• C . Pass-the-hash attacks

• D . Password compromise

201. A bank set up a new server that contains customers' PII. Which of the following should the bank use to make sure the sensitive data is not modified?

• A. Full disk encryption

• B. Network access control

• C. File integrity monitoring

• D. User behavior analytics

494. An organization needs to monitor its users’ activities in order to prevent insider threats. Which of the following solutions would help the organization achieve this goal?

• A. Behavioral analytics

• B. Access control lists

• C. Identity and access management

• D. Network intrusion detection system

454. Executives at a company are concerned about employees accessing systems and information about sensitive company projects unrelated to the employees’ normal job duties. Which of the following enterprise security capabilities will the security team most likely deploy to detect that activity?

• A. UBA

• B. EDR

• C. NAC

• D. DLP

98. A systems administrator receives the following alert from a file integrity monitoring tool:

• The hash of the cmd.exe file has changed.

• The systems administrator checks the OS logs and notices that no patches were applied in the last two months.

• Which of the following most likely occurred?

• A. The end user changed the file permissions.

• B. A cryptographic collision was detected.

• C. A snapshot of the file system was taken.

• D. A rootkit was deployed.

269. A user downloaded software from an online forum. After the user installed the software, the security team observed external network traffic connecting to the user's computer on an uncommon port. Which of the following is the most likely explanation of this unauthorized connection?

• A. The software had a hidden keylogger

• B. The software was ransomware

• C. The user's computer had a fileless virus

• D. The software contained a backdoor

163. Which of the following actions could a security engineer take to ensure workstations and servers are properly monitored for unauthorized changes and software?

• A. Configure all systems to log scheduled tasks.

• B. Collect and monitor all traffic exiting the network.

• C. Block traffic based on known malicious signatures.

• D. Install endpoint management software on all systems.