A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?

• A.Classify the attack vector, understand the scope of the event, and identify the vulnerabilities being exploited
• B.Classify the criticality of the information, research the attacker's motives, and identify missing patches
• C.Determine the attack surface, evaluate the risks involved, and communicate the incident according to the escalation plan
• D.Determine the damage to the business, extract reports, and save evidence according to a chain of custody

Comment: *

Name: *

Email: *

Verification: *

What is the impact of hardening machine images for deployment?

• A.reduces the attack surface
• B.increases the availability of threat alerts
• C.reduces the steps needed to mitigate threats
• D.increases the speed of patch deployment

Comment: *

Name: *

Email: *

Verification: *

Employees report computer system crashes within the same week. An analyst is investigating one of the computers that crashed and discovers multiple shortcuts in the system's startup folder. It appears that the shortcuts redirect users to malicious URLs. What is the next step the engineer should take to investigate this case?

• A.Investigate the malicious URLs
• B.Remove the shortcut files
• C.Identify affected systems
• D.Check the audit logs

Comment: *

Name: *

Email: *

Verification: *

Drag and drop the cloud computing service descriptions from the left onto the cloud service categories on the right.

Correct Answer:

Comment: *

Name: *

Email: *

Verification: *

An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?

• A.Integrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.
• B.Integrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates.
• C.Implement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests.
• D.Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.

Comment: *

Name: *

Email: *

Verification: *