Refer to the exhibit.

An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

• A.It is requesting authentication on the user site.
• B.It is sharing access to files and printers.
• C.It is exploiting redirect vulnerability
• D.It is redirecting to a malicious phishing website,

Comment: *

Name: *

Email: *

Verification: *

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

• A.Inspect registry entries
• B.Inspect processes.
• C.Inspect file hash.
• D.Inspect file type.
• E.Inspect PE header.

Comment: *

Name: *

Email: *

Verification: *

An employee receives an email from a "trusted" person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis?

• A.phishing email sent to the victim
• B.alarm raised by the SIEM
• C.information from the email header
• D.alert identified by the cybersecurity team

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

According to the SNORT alert, what is the attacker performing?

• A.brute-force attack against the web application user accounts
• B.XSS attack against the target webserver
• C.brute-force attack against directories and files on the target webserver
• D.SQL injection attack against the target webserver

Comment: *

Name: *

Email: *

Verification: *

A security team is discussing lessons learned and suggesting process changes after a security breach incident.
During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

• A.Introduce a priority rating for incident response workloads.
• B.Provide phishing awareness training for the full security team.
• C.Conduct a risk audit of the incident response workflow.
• D.Create an executive team delegation plan.
• E.Automate security alert timeframes with escalation triggers.

Comment: *

Name: *

Email: *

Verification: *