Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

• A.due diligence
• B.rapid response
• C.data mining
• D.decision making

Comment: *

Name: *

Email: *

Verification: *

What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

• A.Untampered images are used in the security investigation process
• B.The image is untampered if the stored hash and the computed hash match
• C.The image is tampered if the stored hash and the computed hash match
• D.Tampered images are used in the security investigation process
• E.Tampered images are used in the incident recovery process

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

What is occurring in this network traffic?

• A.high rate of SYN packets being sent from a multiple source towards a single destination IP
• B.flood of ACK packets coming from a single source IP to multiple destination IPs
• C.flood of SYN packets coming from a single source IP to a single destination IP
• D.high rate of SYN packets being sent from a single source IP towards multiple destination IPs

Comment: *

Name: *

Email: *

Verification: *

An analyst is exploring the functionality of different operating systems.
What is a feature of Windows Management Instrumentation that must be considered when deciding on an operating system?

• A.has a Common Information Model, which describes installed hardware and software
• B.deploys Windows Operating Systems in an automated fashion
• C.queries Linux devices that have Microsoft Services for Linux installed
• D.is an efficient tool for working with Active Directory

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

Which application protocol is in this PCAP file?

• A.TCP
• B.HTTP
• C.SSH
• D.TLS

Comment: *

Name: *

Email: *

Verification: *