After a recent malware incident, the forensic investigator is gathering details to identify the breach and causes. The investigator has isolated the affected workstation. What is the next step that should be taken in this investigation?

• A.Review audit logs for privilege escalation events.
• B.Compare workstation configuration and asset configuration policy to identify gaps.
• C.Analyze the applications and services running on the affected workstation.
• D.Inspect registry entries for recently executed files.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

An engineer is reverse engineering a suspicious file by examining its resources. What does this file indicate?

• A.a DOS MZ executable format
• B.a MS-DOS executable archive
• C.an archived malware
• D.a Windows executable file

Comment: *

Name: *

Email: *

Verification: *

An analyst is alerted for a malicious file hash. After analysis, the analyst determined that an internal workstation is communicating over port 80 with an external server and that the file hash is associated with Duqu malware. Which tactics, techniques, and procedures align with this analysis?

• A.Lateral Movement, Remote Services: SMB/Windows Admin Shares, Duqu
• B.Discovery, Remote Services: SMB/Windows Admin Shares, Duqu
• C.Discovery, System Network Configuration Discovery, Duqu
• D.Command and Control, Application Layer Protocol, Duqu

Comment: *

Name: *

Email: *

Verification: *

What is the HTTP response code when the REST API information requested by the authenticated user cannot be found?

• A.401
• B.402
• C.403
• D.404
• E.405

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

An engineer is analyzing this Vlan0386-int12-117.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?

• A.The traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information
• B.The extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible
• C.There is a possible data leak because payloads should be encoded as UTF-8 text
• D.There is a malware that is communicating via encrypted channels to the command and control server

Comment: *

Name: *

Email: *

Verification: *