Heidi runs a vulnerability scan of the management interface of her organization’s virtualization platform and finds the severity 1 vulnerability shown here. What circumstance, if present, should increase the severity level of this vulnerability to Heidi?

Rowan ran a port scan against a network switch located on her organization’s internal network and discovered the results shown here. She ran the scan from her workstation on the employee VLAN. Which one of the following results should be of greatest concern to her?

Evan is troubleshooting a vulnerability scan issue on his network. He is conducting an external scan of a website located on the web server shown in the diagram. After checking the web server logs, he saw no sign of the scan requests. Which one of the following causes is the least likely issue for him to troubleshoot?

Sam is looking for evidence of software that was installed on a Windows system. He believes that the programs were deleted and that the suspect used both registry and log cleaners to hide evidence. What Windows feature can’t he use to find evidence of the use of these programs?

Mila is evaluating the security of an application developed within her organization. She would like to assess the application’s security by supplying it with invalid inputs. What technique is Mila planning to use?

A port scan conducted during a security assessment shows the following results. What type of device has most likely been scanned?

--View Image--

Which of the following is not one of the major categories of security event indicators

described by NIST 800-61?

During an nmap scan of a network, Charles receives the following response from nmap:

Starting Nmap 7.80 ( https://nmap.org )

Nmap done: 256 IP addresses (0 hosts up) scanned in 29.74 seconds

What can Charles deduce about the network segment from these results?

Oskar is designing a vulnerability management program for his company, a hosted service

provider. He would like to check all relevant documents for customer requirements that

may affect his scanning. Which one of the following documents is least likely to contain this

information?

During a port scan of a server, Gwen discovered that the following ports are open on the

internal network:

TCP port 25.

TCP port 80.

TCP port 110.

TCP port 443.

TCP port 1521.

TCP port 3389.

Of the services listed here, for which one does the scan not provide evidence that it is likely

running on the server?

As part of her forensic analysis of a wiped thumb drive, Selah runs Scalpel to carve data from the image she created. After running Scalpel, she sees the following in the audit.log file created by the program. What should Selah do next?

Lonnie ran a vulnerability scan of a server that he recently detected in his organization that is not listed in the organization’s configuration management database. One of the vulnerabilities detected is shown here. What type of service is most likely running on this server?

Jorge would like to use a standardized system for evaluating the severity of security

vulnerabilities. What SCAP component offers this capability?

When performing threat-hunting activities, what are cybersecurity analysts most directly seeking?

Taylor is preparing to run vulnerability scans of a web application server that his organization recently deployed for public access. He would like to understand what information is available to a potential external attacker about the system as well as what damage an attacker might be able to cause on the system. Which one of the following scan types would be least likely to provide this type of information?

While analyzing a packet capture in Wireshark, Chris finds the packet shown here. Which of the following is he unable to determine from this packet?

Cynthia’s review of her network traffic focuses on the graph shown here. What occurred in late June?

Carlos arrived at the office this morning to find a subpoena on his desk requesting electronic records in his control. What type of procedure should he consult to determine appropriate next steps, including the people he should consult and the technical process he should follow?

Which stage of the incident response process includes activities such as adding IPS signatures to detect new attacks?

Gloria is configuring vulnerability scans for a new web server in her organization. The server is located on the screened subnet (DMZ) network, as shown here. What type of scans should Gloria configure for best results?

--View Image--

Pranab is preparing to reuse media that contained data that his organization classifies as having “moderate” value. If he wants to follow NIST SP 800-88’s guidelines, what should he do to the media if the media will not leave his organization’s control?

Susan is building an incident response program and intends to implement NIST’s recommended actions to improve the effectiveness of incident analysis. Which of the following items is not an NIST-recommended

incident analysis improvement?

Jim’s nmap port scan of a remote system showed the following list of ports:

--View Image--

What operating system is the remote system most likely running?

Helen is seeking to protect her organization against attacks that involve the theft of user credentials.

In most organizations, which one of the following threats poses the greatest risk of

credential theft?

As part of her duties as a security operations center (SOC) analyst, Emily is tasked with monitoring intrusion detection sensors that cover her employer’s corporate headquarters network. During her shift, Emily’s IDS reports that a network scan has occurred from a system with IP address 10.1. 1.19 on the organization’s unauthenticated guest wireless network aimed at systems on an external network. What should Emily’s first step be?

Sai works in an environment that is subject to the Payment Card Industry Data Security Standard (PCI DSS). He realizes that technical constraints prevent the organization from meeting a specific PCI DSS requirement and wants to implement a compensating control. Which one of the following statements is not true about proper compensating controls?

Lou recently scanned a web server in his environment and received the vulnerability report shown here. What action can Lou take to address this vulnerability?

--View Image--

Which of the following factors is not typically considered when determining whether evidence should be retained?

Match each of the following with the appropriate element of the CIA triad:

1. A hard drive failure resulting in a service outage

2. A termination letter that is left on a printer and read by others in the department

3. Modification of an email’s content by a third party

Niesha discovered the vulnerability shown here on a server running in her organization. What would be the best way for Niesha to resolve this issue?

--View Image--

As part of her postincident recovery process, Alicia creates a separate virtual network as shown here to contain compromised systems she needs to investigate. What containment technique is she using?

Jennifer is reviewing her network monitoring configurations and sees the following chart for a system she runs remotely in Amazon’s Web Services (AWS) environment more than 400 miles away. What can she use this data for?

The Windows system that Abdul is conducting live forensics on shows a partition map, as shown here. If Abdul believes that a hidden partition was deleted resulting in the unallocated space, which of the following type of tool is best suited to identifying the data found in the unallocated space?

During a postmortem forensic analysis of a Windows system that was shut down after its user saw strange behavior, Pranab concludes that the system he is reviewing was likely infected with a memory-resident

malware package. What is his best means of finding the malware?

Juliette’s organization recently suffered a cross-site scripting attack, and she plans to implement input validation to protect against the recurrence of such attacks in the future. Which one of the following HTML tags should be most carefully scrutinized when it appears in user input?

Jessie needs to prevent port scans like the scan shown here. Which of the following is a valid method for preventing port scans?

--View Image--

What information can be gathered by observing the distinct default values of the following TCP/IP fields during reconnaissance activities: initial packet size, initial TTL, window size, maximum segment size, and flags?

Brooke would like to find a technology platform that automates workflows across a variety of security tools, including the automated response to security incidents. What category of tool best meets this need?

Miray needs to identify the device or storage type that has the lowest order of volatility.

Which of the following is the least volatile?

After receiving complaints about a system on Anastasia’s network not performing correctly, she decides to investigate the issue by capturing traffic with Wireshark. The captured traffic is shown here. What type of issue is Anastasia most likely seeing?

After finishing a forensic case, Lucas needs to wipe the media that he is using to prepare it for the next case. Which of the following methods is best suited to preparing the SSD that he will use?

Luis is creating a vulnerability management program for his company. He only has the resources to conduct daily scans of approximately 10 percent of his systems, and the rest will be scheduled for weekly scans. He would like to ensure that the systems containing the most sensitive information receive scans on a more frequent basis. What criterion is Luis using?