Which tool conducts memory analysis?

• A.MemDump
• B.Sysinternals Autoruns
• C.Volatility
• D.Memoryze

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. What should an engineer determine from this Wireshark capture of suspicious network traffic?

• A.There are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections.
• B.There are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to- MAC address mappings as a countermeasure.
• C.There are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure.
• D.There are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

What is occurring?

• A.Obfuscated scripts are getting executed on the victim machine.
• B.Malware is modifying the registry keys.
• C.RDP is used to move laterally to systems within the victim environment.
• D.The threat actor creates persistence by creating a repeatable task.

Comment: *

Name: *

Email: *

Verification: *

An investigator notices that GRE packets are going undetected over the public network. What is occurring?

• A.encryption
• B.tunneling
• C.decryption
• D.steganography

Comment: *

Name: *

Email: *

Verification: *

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

• A.process injection
• B.privilege escalation
• C.GPO modification
• D.token manipulation

Comment: *

Name: *

Email: *

Verification: *