Refer to the exhibit.
192.168.1.1 - - [10/Oct/2023:13:55:36 +0000] " GET /index.html HTTP/1.1 " 200 532
192.168.1.2 - - [10/Oct/2023:13:56:01 +0000] " POST /login.php HTTP/1.1 " 302 1234
203.0.113.5 - - [10/Oct/2023:13:56:56 +0000] " GET /images/logo.png HTTP/1.1 " 200 2067
198.51.100.23 - - [10/Oct/2023:13:57:32 +0000] " GET /robots.txt HTTP/1.1 " 404 234
203.0.113.7 - - [10/Oct/2023:13:58:16 +0000] " GET /admin?user=test & pass=012345678 HTTP/1.1 "
203.0.113.7 - - [10/Oct/2023:13:58:16 +0000] " GET /admin?user=test & pass=012345679 HTTP/1.1 "
203.0.113.7 - - [10/Oct/2023:13:58:16 +0000] " GET /admin?user=test & pass=012345680 HTTP/1.1 "
203.0.113.7 - - [10/Oct/2023:13:58:16 +0000] " GET /admin?user=test & pass=012345681 HTTP/1.1 "
203.0.113.7 - - [10/Oct/2023:13:58:16 +0000] " GET /admin?user=test & pass=012345682 HTTP/1.1 "
203.0.113.7 - - [10/Oct/2023:13:58:16 +0000] " GET /admin?user=test & pass=012345683 HTTP/1.1 " An engineer analyzes an incomplete traffic log obtained from Apache. The web server reportedly suffered sudden performance degradation and then crashed. Based on the log, a potential cause must be determined before the server is restarted. Which action would prevent the server from experiencing the same problem again?

• A.Set up a web application firewall in front of the web server with request limits per IP address.
• B.Prevent the password 012345678 from being used by any IP address outside the internal subnet.
• C.Investigate other areas of the server because nothing in the logs indicates a problem.
• D.Configure IP-reputation blocking through a web application firewall in front of the web server.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

What should be determined from this Apache log?

• A.A module named mod_ssl is needed to make SSL connections.
• B.The private key does not match with the SSL certificate.
• C.The certificate file has been maliciously modified
• D.The SSL traffic setup is improper

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hours prior. Which two indicators of compromise should be determined from this information? (Choose two.)

• A.unauthorized system modification
• B.privilege escalation
• C.denial of service attack
• D.compromised root access
• E.malware outbreak

Comment: *

Name: *

Email: *

Verification: *

• A.Evaluate the artifacts in Cisco Secure Malware Analytics.
• B.Evaluate the file activity in Cisco Umbrella.
• C.Analyze the registry activity section in Cisco Umbrella.
• D.Analyze the activity paths in Cisco Secure Malware Analytics.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?

• A.DNS spoofing; encrypt communication protocols
• B.SYN flooding, block malicious packets
• C.ARP spoofing; configure port security
• D.MAC flooding; assign static entries

Comment: *

Name: *

Email: *

Verification: *