1. A denial-of-service attack
2. A link failure
3. High bandwidth consumption
4. Beaconing

1. Windows systems
2. Systems involved in the incident
3. Linux systems
4. Web servers

1. Heuristic attack detection methods
2. Signature-based attack detection methods
3. Segmentation
4. Leverage threat intelligence

1. Windows registry
2. Master File Table
3. INDX files
4. Event logs

1. Host firewall logs
2. AD authentication logs
3. Wireless authentication logs
4. WAF logs

1. Live image to an external drive.
2. Live image to the system's primary drive.
3. Take the system offline and image to an external drive.
4. Take the system offline, install a write blocker on the system's primary drive, and then image it to an external drive.

1. Nmap cannot tell whether the port is open or closed.
2. A firewall was detected.
3. An IPS was detected.
4. There is no application listening, but there may be one at any time.

1. Internal host B was previously compromised.
2. Host A was compromised; then host B was compromised.
3. Neither host B nor host A are synchronized to NTP properly.
4. An internal threat compromised host B and then host A.

1. Server A
2. Server B
3. Server C
4. Server D

1. Low
2. Medium
3. High
4. Cannot be determined from the information given

1. Hank should inform the CEO that this would have a negative impact on system performance and is not recommended.
2. Hank should immediately implement the CEO's suggestion.
3. Hank should consider the request and work with networking and engineering teams on possible implementation.
4. Hank should inform the CEO that there is no incremental security benefit from this approach and that he does not recommend it.

1. Confidentiality
2. Availability
3. Integrity
4. Accountability

1. Qualys Top 20 Report
2. Payment Card Industry (PCI) Technical Report
3. Executive Report
4. Technical Report

What action should Jiang take based on this information?

1. He should increase the speed of his network link.
2. He should check for scheduled tasks at the times he sees spikes.
3. He should ensure that his network card has the proper latency settings.
4. He should perform additional diagnostics to determine the cause of the latency.

1. UDP-based port scanning
2. Network discovery via TCP
3. SYN-based port scanning
4. DNS-based discovery

1. if
2. bs
3. of
4. count

1. It prevents attackers from targeting production servers.
2. It provides information about the techniques attackers are using.
3. It slows down attackers like sticky honey.
4. It provides real-time input to IDSs and IPSs.

1. A Trojan horse
2. An APT
3. A rootkit
4. A zero-day attack

1. Number of critical vulnerabilities resolved
2. Time to resolve critical vulnerabilities
3. Number of new critical vulnerabilities per month
4. Time to complete vulnerability scans

1. The system is not running any open services.
2. All services are firewalled.
3. There are no TCP services reachable on Nmap's default 1000 TCP ports.
4. There are no TCP services reachable on Nmap's default 65535 TCP ports.

1. To prove that the drive's contents were not altered
2. To prove that no data was deleted from the drive
3. To prove that no files were placed on the drive
4. All of the above

1. Verify that all patches are installed.
2. Destroy the system.
3. Validate the BIOS hash against a known good version.
4. Check for a system with a duplicate MAC address.

1. She can determine that the user was viewing a GIF.
2. She can manually review the TCP stream to see what data was sent.
3. She can export and view the GIF.
4. She cannot determine what media was accessed using this data set.

1. MITRE ATT&CK
2. Diamond
3. Cyber Kill Chain
4. STIX

1. nmap -p0 -all -SC
2. nmap -p 1-32768 -sVS
3. nmap -p 1-65535 -sV -sS
4. nmap -all -sVS

1. SaaS
2. PaaS
3. FaaS
4. IaaS

1. Dan should immediately remediate this vulnerability.
2. Dan should schedule the vulnerability for remediation within the next 30 days.
3. Dan should rerun the scan because this is likely a false positive report.
4. Dan should take no action.

1. Application server logs
2. Database server logs
3. Firewall logs
4. Antimalware logs

1. Agent-based scan
2. Credentialed scan
3. Uncredentialed internal scan
4. Uncredentialed external scan

1. Degauss the drive.
2. Zero-write the drive.
3. Seven rounds: all ones, all zeros, and five rounds of random values.
4. Use the ATA Secure Erase command.

1. Preparation
2. Detection and analysis
3. Containment, eradication, and recovery
4. Post-incident activity

1. Firewalling
2. Patching
3. Isolation
4. Segmentation

1. Segmentation
2. Isolation
3. Removal
4. Network locking

1. /var/log/commands.log
2. $HOME/.bash_history
3. $HOME/.commands.sqlite
4. /var/log/authactions.log

1. Risk avoidance
2. Risk acceptance
3. Risk transference
4. Risk mitigation

1. Task 1
2. Task 2
3. Task 3
4. Task 4

1. On-path (man-in-the-middle)
2. Privilege escalation
3. Cross-site scripting
4. Session hijacking

1. NTFS INDX files
2. The registry
3. Event logs
4. Prefetch files

1. Order of volatility
2. Data transience
3. Data loss prediction
4. The Volatility Framework

1. Visit otx.alienvault.com and the suspected C&C system's IP address on the top search input field.
2. If the IP address is associated with malware C&C activity, create a ticket in the incident response tracking system.

1. Creating a CSIRT
2. Creating a playbook
3. Creating an incident response plan
4. Creating an IR-FAQ

1. Move from TLS 1.0 to SSL 3.0.
2. Require IPsec connections to the server.
3. Disable the use of TLS.
4. Move from TLS 1.0 to TLS 1.3.

1. DNS query logs
2. Threat intelligence feeds
3. Honeypot data
4. Notifications from internal staff about suspicious behavior

1. Buffer overflow
2. Session hijacking
3. IP spoofing
4. Open redirect

1. To document the penetration test
2. To scan for vulnerabilities
3. To gather additional information about systems and services
4. To troubleshoot issues encountered when connecting to targets

1. Rich should inform the team that they need to run the ETL jobs on a different schedule.
2. Rich should reconfigure the scans to run during business hours.
3. Rich should inform the team that they must resize the hardware to accommodate both requirements.
4. Rich should work with the team to find a mutually acceptable solution.

1. Javier misconfigured the scan.
2. The code is deficient and requires correction.
3. The vulnerability is in a different web application running on the same server.
4. The result is a false positive.

1. The identity of the attacker
2. The country of origin of the attacker
3. The attacker's domain name
4. None of the above

1. Sandboxing
2. Removal
3. Isolation
4. Segmentation

1. She should deploy the patch immediately on the production system.
2. She should wait 60 days to deploy the patch to determine whether bugs are reported.
3. She should deploy the patch in a sandbox environment to test it prior to applying it in production.
4. She should contact the vendor to determine a safe time frame for deploying the patch in production.

1. The server requires strong authentication.
2. The server uses encryption.
3. The scan was run from a different network perspective than user traffic.
4. The scanner's default settings do not check the ports used by the CRM application.

1. nmap -P0 -sT 10.0.10.0/24
2. nmap -sT -T0 10.0.10.0/24
3. nmap -P0 -sS 10.0.10.0/24
4. nmap -P0 -sS -T0 10.0.10.0/24

1. Establishing a hypothesis
2. Gathering evidence
3. Reducing the attack surface
4. Executable process analysis

1. Sensitivity of information stored on systems
2. Criticality of the business processes handled by systems
3. Operating system installed on systems
4. Exposure of the system to external networks

1. Severity 5 vulnerability in the file server
2. Severity 3 vulnerability in the file server
3. Severity 4 vulnerability in the web server
4. Severity 2 vulnerability in the mail server

1. Policy
2. Standard
3. Procedure
4. Framework

1. Mateo should provide the administrators with access.
2. Mateo should deny the administrators access because the information may reveal critical security issues.
3. Mateo should offer to provide the administrators with copies of the report after they go through a security review.
4. Mateo should deny the administrators access because it would allow them to correct security issues before they are analyzed by the security team.

1. Block ports 80 and 443.
2. Adjust directory permissions.
3. Block port 80 only to require the use of encryption.
4. Remove CGI from the server.

1. A security incident
2. A security event
3. An event
4. An adverse event

1. A host firewall is blocking access to the server.
2. A network firewall is blocking access to the server.
3. An intrusion prevention system is blocking access to the server.
4. Fran is scanning the wrong IP address.

1. The multifactor system provides two independent factors and provides an effective security control.
2. The factors used are both the same type of factor, making the control less effective.
3. The system uses only two factors and is not a true multifactor system. To qualify as multifactor, it should include at least three factors.
4. The multifactor system's use of a four-digit PIN does not provide sufficient complexity, and additional length should be required for any PIN for secure environments.

1. Time of day
2. Location
3. Device fingerprint
4. All of the above

1. Increased password complexity requirements
2. Application or token-based multifactor authentication
3. Biometric-based multifactor authentication
4. OAuth-based single sign-on

        root@demo:~# md5sum -c demo.md5
        demo.txt: FAILED
        md5sum: WARNING: 1 computed checksum did not match

1. The file is corrupted.
2. Attackers have modified the file.
3. The files do not match.
4. The test failed and provided no answer.

1. Relying party
2. Service provider
3. Identity provider
4. Consumer

1. Something she knows and something she has.
2. Something she knows and something she is.
3. Something she is and something she has.
4. Mika is using only one type of factor because she knows the token code and her password.

1. Location factor
2. Knowledge factor
3. Possession factor
4. Biometric factor

1. Using secure session management
2. Enabling logging on the database
3. Performing user input validation
4. Implementing TLS

1. Attackers may learn about the vulnerabilities.
2. Services may be crashed by the scanner.
3. The vulnerability scanner may be exploited by attackers.
4. Too many vulnerabilities may be detected.

1. A session hijacking attack
2. An on-path (man-in-the-middle) attack
3. A credential stuffing attack
4. A password spraying attack

1. Inform the media immediately of developments in the investigation.
2. Conduct practice sessions for incident responders who communicate with the media.
3. Establish media briefing procedures in advance of an incident.
4. Maintain an incident response status document.

1. Dynamic analysis
2. Fuzzing
3. Static analysis
4. Reverse engineering

http://example.com/../../../../../etc/shadow

1. A buffer overflow attack
2. An attack on the heap
3. A session hijacking attack
4. A directory traversal attack

1. Parameterized queries
2. Encoding data
3. Input validation
4. Appropriate access controls

1. Document the analysis.
2. Differentiate between each of the events and causal factors.
3. Identify the problems and events that occurred.
4. Establish a timeline.

1. Establishing a hypothesis
2. Conducting a security lockdown
3. Reducing the attack surface areas
4. Bundling critical assets

1. CVSS score
2. Confidentiality rating
3. Impact rating
4. Likelihood rating

1. Mean time to respond
2. Mean time to remediate
3. Alert volume
4. Mean time to detect

1. Threat hunting
2. Intrusion analysis
3. Qualitative risk assessment
4. Data backup

1. Spamhaus
2. DKIM
3. SPF
4. RBL

1. Awareness, training, and education
2. Compensating controls
3. Patch management
4. Changing business requirements

1. Timeliness
2. Accuracy
3. Relevancy
4. Superficial

1. IDS
2. FSB
3. DLP
4. FDE

What file type from the following list is he most likely reviewing?

1. Plaintext
2. JSON
3. XML
4. HTML

1. Legal hold
2. Litigation priority
3. Criminal suspension
4. A data summons

1. Handoff documentation
2. Chain of custody tracking
3. Asset tracking
4. Forensic certification