Drag and drop the steps from the left into the order to perform forensics analysis of infrastructure networks on the right.

Correct Answer:

Reference: https://subscription.packtpub.com/book/networking_and_servers/9781789344523/1/ ch01lvl1sec12
/network-forensics-investigation-methodology

Comment: *

Name: *

Email: *

Verification: *

A threat intelligence report identifies an outbreak of a new ransomware strain spreading via phishing emails that contain malicious URLs. A compromised cloud service provider, XYZCloud, is managing the SMTP servers that are sending the phishing emails. A security analyst reviews the potential phishing emails and identifies that the email is coming from XYZCloud. The user has not clicked the embedded malicious URL.
What is the next step that the security analyst should take to identify risk to the organization?

• A.Reset the reporting user's account and enable multifactor authentication.
• B.Create a detailed incident report and share it with top management.
• C.Find any other emails coming from the IP address ranges that are managed by XYZCloud.
• D.Delete email from user mailboxes and update the incident ticket with lessons learned.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. Which type of code created the snippet?

• A.VB Script
• B.Python
• C.PowerShell
• D.Bash Script

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

What is the indicator of compromise?

• A.SHA256 file hash
• B.indicator ID: malware--a932fcc6-e032-476c-826f-cb970a569bce
• C.indicator type: malicious-activity
• D.MD5 file hash

Comment: *

Name: *

Email: *

Verification: *

An organization publishes a Microsoft Exchange Outlook Web App (OWA) server to provide access to enterprise email and deploys a web application firewall in front of it. Microsoft announces a newly discovered zero-day vulnerability that is being actively exploited. The vulnerability is triggered by a specially crafted request to an uncommonly used URL, and a patch is still being developed. Which action immediately protects the organization?

• A.Install the patch for the vulnerability as soon as it becomes available.
• B.Use the web application firewall to block access to the exploited URL.
• C.Deploy a custom IDS signature to detect successful exploitation of the vulnerability.
• D.Use a stateful firewall to disable access to OWA ports.

Comment: *

Name: *

Email: *

Verification: *