Refer to the exhibit. An engineer is investigating a case with suspicious usernames within the active directory.
After the engineer investigates and cross-correlates events from other sources, it appears that the 2 users are privileged, and their creation date matches suspicious network traffic that was initiated from the internal network 2 days prior. Which type of compromise is occurring?

• A.compromised root access
• B.compromised database tables
• C.compromised insider
• D.compromised network

Comment: *

Name: *

Email: *

Verification: *

A threat actor attacked an organization's Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded. When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator's account was disabled. Which activity triggered the behavior analytics tool?

• A.accessing the Active Directory server
• B.accessing the server with financial data
• C.downloading more than 10 files
• D.accessing multiple servers

Comment: *

Name: *

Email: *

Verification: *

Drag and drop the actions below the image onto the boxes in the image for the actions that should be taken during this playbook step. Not all options are used.

Correct Answer:

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

Cisco Advanced Malware Protection installed on an end-user desktop has automatically submitted a low prevalence file to the Threat Grid analysis engine for further analysis. What should be concluded from this report?

• A.The prioritized behavioral indicators of compromise do not justify the execution of the "ransomware" because the scores do not indicate the likelihood of malicious ransomware.
• B.The prioritized behavioral indicators of compromise do not justify the execution of the "ransomware" because the scores are high and do not indicate the likelihood of malicious ransomware.
• C.The prioritized behavioral indicators of compromise justify the execution of the "ransomware" because the scores are low and indicate the likelihood that malicious ransomware has been detected.
• D.The prioritized behavioral indicators of compromise justify the execution of the "ransomware" because the scores are high and indicate the likelihood that malicious ransomware has been detected.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. What is the connection status of the ICMP event?

• A.blocked by a configured access policy rule
• B.allowed by a configured access policy rule
• C.blocked by an intrusion policy rule
• D.allowed in the default action

Comment: *

Name: *

Email: *

Verification: *