Refer to the exhibit.

What does the exhibit indicate?

• A.The new file is created under the Software\Classes disk folder.
• B.A UAC bypass is created by modifying user-accessible registry settings.
• C.A scheduled task named " DelegateExecute " is created.
• D.The shell software is modified via PowerShell.

Comment: *

Name: *

Email: *

Verification: *

A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

• A.Automate security alert timeframes with escalation triggers.
• B.Create an executive team delegation plan.
• C.Conduct a risk audit of the incident response workflow.
• D.Provide phishing awareness training for the fill security team.
• E.Introduce a priority rating for incident response workloads.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

Which type of code is being used?

• A.Shell
• B.VBScript
• C.BASH
• D.Python

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.
No. Time Source Destination Protocol Length Info
4001 11.001245 192.168.10.5 172.217.20.14 TLSv1.2 1514 Client Hello
4002 11.002331 172.217.20.14 192.168.10.5 TLSv1.2 1514 Server Hello, Certificate
4003 11.003112 192.168.10.5 172.217.20.14 TLSv1.2 314 Client Key Exchange
4004 11.004551 172.217.20.14 192.168.10.5 TLSv1.2 286 Change Cipher Spec
4005 11.005778 192.168.10.5 172.217.20.14 TLSv1.2 1298 Application Data What does the log activity indicate?

• A.HTTP file transfer via TLS
• B.DNS query exchange
• C.Failed TCP connection
• D.TLS session between two hosts

Comment: *

Name: *

Email: *

Verification: *

A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify the file's behavior. Which logs should be reviewed next to evaluate this file further?

• A.network device
• B.email security appliance
• C.Antivirus solution
• D.DNS server

Comment: *

Name: *

Email: *

Verification: *