A new zero-day vulnerability is discovered in the web application. Vulnerability does not require physical access and can be exploited remotely. Attackers are exploiting the new vulnerability by submitting a form with malicious content that grants them access to the server. After exploitation, attackers delete the log files to hide traces. Which two actions should the security engineer take next? (Choose two.)

• A.Validate input upon submission.
• B.Block connections on port 443.
• C.Install antivirus.
• D.Update web application to the latest version.
• E.Enable file integrity monitoring.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

Which type of code created the snippet?

• A.VB Script
• B.Python
• C.PowerShell
• D.Bash Script

Comment: *

Name: *

Email: *

Verification: *

An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document. The engineer cannot identify any clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was spawned by cmd.exe with a grandparent winword.exe process. What is the recommended action the engineer should take?

• A.Contain the threat for further analysis as this is an indication of suspicious activity.
• B.Upload the file signature to threat intelligence tools to determine if the file is malicious.
• C.Investigate the sender of the email and communicate with the employee to determine the motives.
• D.Monitor processes as this a standard behavior of Word macro embedded documents.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. What encoding technique is shown?
QmFzZTY0IGVuY29kaW5nIGlzIGEgd2lkZWx5IHVzZWQgbWV0aG9kIGZvciBjb252ZXJ0aW5nIGJpbmFye

• A.JavaScript
• B.Hexadecimal
• C.ASCII85
• D.Base64

Comment: *

Name: *

Email: *

Verification: *

A threat intelligence report identifies an outbreak of a new ransomware strain spreading via phishing emails that contain malicious URLs. A compromised cloud service provider, XYZCloud, is managing the SMTP servers that are sending the phishing emails. A security analyst reviews the potential phishing emails and identifies that the email is coming from XYZCloud. The user has not clicked the embedded malicious URL.
What is the next step that the security analyst should take to identify risk to the organization?

• A.Reset the reporting user's account and enable multifactor authentication.
• B.Create a detailed incident report and share it with top management.
• C.Delete email from user mailboxes and update the incident ticket with lessons learned.
• D.Find any other emails coming from the IP address ranges that are managed by XYZCloud.

Comment: *

Name: *

Email: *

Verification: *