Which of the following best describes true statements regarding traditional flow analysis versus flow analysis for cybersecurity? Select two.

After a security breach, a small company is cooperating with security consultants as they investigate IOC. Which of the following are activities the security consultants are most likely to undertake? Select two.

Security professionals examined the contents of a malicious file and were able to identify various filenames and IP addresses used in a successful breach. Which of the following best describes what allowed them to identify these digital artifacts?

A company is analyzing suspicious emails received from an unfamiliar domain. Which of the following is most likely to be true regarding the transmission of the emails? Select three.

A company with no business ties to foreign entities is analyzing network traffic using a tool with a GUI interface. They notice traffic headed to a remote endpoint with an unfamiliar IP address in a foreign country. What tool most likely helped them discover the suspicious IP addresses?

An IT professional at Company A is configuring a new email server. They want the option to publish a policy on their DNS that allows for the greatest degree of flexibility in terms of recipients being able to verify various aspects of email messages sent from Company A. Which of the following best describes what the IT professional should configure?

A branch office is analyzing log files. They notice entries from two different devices that appear almost identical except for the time stamp, which is always 10 seconds apart. Which of the following represents a reasonable course of action as they investigate the issue?

Alfredo receives an email at work from what appears to be his bank stating the bank's password policy has changed. The message says he needs to use a stronger password and contains instructions to click on the supplied link to reset it. Which of the following could explain why Alfredo received this email?

Which of the following best describes characteristics of DKIM? Select three.

A threat actor successfully breaches the perimeter of an organization and decides to use the Windows Command Shell instead of PowerShell to launch an attack. Considering the Windows Command Shell is more limited in its capabilities, why would the threat actor opt to use it?

A security analyst is researching the behavior of Word documents that contain hidden VBA code that issues calls to execute other files. Which of the following will help the analyst identify a pool of files that meet this criterion?

A user at an organization receives an email from the helpdesk requesting an immediate password reset using the attached instructions and link in the email because the user's account has been compromised. Which of the following could be true? Select three.

A security professional installs SSDT View while analyzing files for malware. What is the security professional trying to determine?

A security professional at a large company is responsible for researching and implementing a solution that includes monitoring endpoint devices. Which of the following will provide the most robust solution?

A mid-sized company is growing fast and needs cybersecurity capabilities above and beyond what they currently have, including the ability to have automated responses to most security threats. What type of system should they adopt?

A company is considering implementing UBA by installing software agents on their VMs to create a profile of every application they use. However, since threat actors can bypass those agents by disabling them, what alternative should they consider?

A security professional is analyzing log files. They notice a successful login attempt from the east coast at 1:00 p.m. eastern time. They also notice a login attempt from the west coast, almost 3000 miles away, at 2:00 p.m. eastern time that was denied even though the correct credentials were supplied. Which of the following is most likely to be true?

A threat actor is determined to minimize the possibility of revealing strings in their malicious program that can expose their attack strategy. Which of the following is a technique the threat actor is most likely to implement?

An organization contacts a cybersecurity consulting firm to help address the volume of log data to be analyzed. The problem is compounded by the number of devices and apps generating logs using different formats. Which of the following is the consulting firm most likely to recommend or implement?

A confident, but inexperienced, security technician accepts their first job after graduating with a certificate in security. Part of their responsibilities include analyzing files for evidence of malware. The technician creates a VM, copies the files into the VM, and starts analyzing the files. However, the VM has normal connectivity to the network. Which of the following is a true statement?

Which of the following best describes the differences or similarities between packet analysis and protocol analysis? Select two.

A user downloads an operating system image file from a website. The user wants to confirm the file has not been infected. Which of the following is most likely to be included in the steps the user will perform to help confirm the file has not been infected? Select two.

Which of the following accurately represents functions a SIEM is capable of performing?

A few members of the IT team at a company in New York City travel to Australia. Their goal is to set up and harden the network at a new sales office. During lunch, one of the members tries to log in to their bank but access is continually denied. Which of the following are the most likely reasons why access is denied? Select three.