Refer to the exhibit.

A security analyst is reviewing alerts from the SIEM system that was just implemented and notices a possible indication of an attack because the SSHD system just went live and there should be nobody using it. Which action should the analyst take to respond to the alert?

• A.Investigate the alert by checking SSH logs and correlating with other relevant data in SIEM.
• B.Reset the admin password in SSHD to prevent unauthorized access to the system at scale.
• C.Ignore the alert and continue monitoring for further activity because the system was just implemented.
• D.Immediately block the IP address 192.168.1.100 from accessing the SSHD environment.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. Which determination should be made by a security analyst?

• A.An email was sent with an attachment named "Grades.doc".
• B.An email was sent with an attachment named "Final Report.doc".
• C.An email was sent with an attachment named "Final Report.doc.exe".
• D.An email was sent with an attachment named "Grades.doc.exe".

Comment: *

Name: *

Email: *

Verification: *

An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document. The engineer cannot identify any clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was spawned by cmd.exe with a grandparent winword.exe process. What is the recommended action the engineer should take?

• A.Upload the file signature to threat intelligence tools to determine if the file is malicious.
• B.Monitor processes as this is standard behavior of Word macro embedded documents.
• C.Contain the threat for further analysis as this is an indication of suspicious activity.
• D.Investigate the sender of the email and communicate with the employee to determine the motives.

Comment: *

Name: *

Email: *

Verification: *

What is the goal of an incident response plan?

• A.to identify critical systems and resources in an organization
• B.to ensure systems are in place to prevent an attack
• C.to determine security weaknesses and recommend solutions
• D.to contain an attack and prevent it from spreading

Comment: *

Name: *

Email: *

Verification: *

An organization experienced a sophisticated phishing attack that resulted in the compromise of confidential information from thousands of user accounts. The threat actor used a land and expand approach, where initially accessed account was used to spread emails further. The organization ' s cybersecurity team must conduct an in-depth root cause analysis to uncover the central factor or factors responsible for the success of the phishing attack. The very first victim of the attack was user with email [email protected]. The primary objective is to formulate effective strategies for preventing similar incidents in the future. What should the cybersecurity engineer prioritize in the root cause analysis report to demonstrate the underlying cause of the incident?

• A.investigation into the specific vulnerabilities or weaknesses in the organization ' s email security systems that were exploited by the attackers
• B.evaluation of the organization ' s incident response procedures and the performance of the incident response team
• C.examination of the organization ' s network traffic logs to identify patterns of unusual behavior leading up to the attack
• D.comprehensive analysis of the initial user for presence of an insider who gained monetary value by allowing the attack to happen

Comment: *

Name: *

Email: *

Verification: *