A company's IIS web server is breached, and the attacker accesses a Microsoft Windows Server 2016 host by exploiting an SMB vulnerability on the same subnet. The intruder shuts down critical services on the Windows server. A security engineer must retrieve the IIS logs from the web server and service-related logs from the Windows server. Which two actions accomplish this task? (Choose two.)

• A.Export the full Security log from Event Viewer on the Windows server.
• B.Copy the log files from the %SystemDrive%\inetpub\logs\LogFiles folder on the IIS server.
• C.Copy the log files from the C:\Windows\Temp\Logs folder on the IIS server.
• D.Export System Log > Service Control Manager events from Event Viewer on the Windows server.
• E.Export Security Log > Service Control Manager events from Event Viewer on the IIS server.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

A cybersecurity analyst is presented with the snippet of code used by the threat actor and left behind during the latest incident and is asked to determine its type based on its structure and functionality. What is the type of code being examined?

• A.simple client-side script for downloading other elements
• B.basic web crawler for indexing website content
• C.network monitoring script for capturing incoming traffic
• D.socket programming listener for TCP/IP communication

Comment: *

Name: *

Email: *

Verification: *

What are two features of Cisco Secure Endpoint? (Choose two.)

• A.file trajectory
• B.rogue wireless detection
• C.Orbital Advanced Search
• D.web content filtering
• E.full disk encryption

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

Which two actions should be taken as a result of this information? (Choose two.)

• A.Update the AV to block any file with hash "cf2b3ad32a8a4cfb05e9dfc45875bd70".
• B.Block all emails sent from an @state.gov address.
• C.Block all emails with pdf attachments.
• D.Block all emails with subject containing "cf2b3ad32a8a4cfb05e9dfc45875bd70".
• E.Block emails sent from [email protected] with an attached pdf file with md5 hash "cf2b3ad32a8a4cfb05e9dfc45875bd70".

Comment: *

Name: *

Email: *

Verification: *

During a routine inspection of system logs, a security analyst notices an entry where Microsoft Word initiated a PowerShell command with encoded arguments. Given that the user's role does not involve scripting or advanced document processing, which action should the analyst take to analyze this output for potential indicators of compromise?

• A.Monitor the Microsoft Word startup times to ensure they align with business hours.
• B.Confirm that the Microsoft Word license is valid and the application is updated to the latest version.
• C.Validate the frequency of PowerShell usage across all hosts to establish a baseline.
• D.Review the encoded PowerShell arguments to decode and determine the intent of the script.

Comment: *

Name: *

Email: *

Verification: *