A cybersecurity analyst is doing triage in a SIEM and notices that the time stamps between the firewall and the host under investigation are off by 43 minutes. Which of the following is the most likely scenario occurring with the time stamps?

• A.The NTP server is not configured on the host.
• B.The cybersecurity analyst is looking at the wrong information.
• C.The firewall is using UTC time.
• D.The host with the logs is offline.

Comment: *

Name: *

Email: *

Verification: *

A managed security service provider is having difficulty retaining talent due to an increasing workload caused by a client doubling the number of devices connected to the network. Which of the following would best aid in decreasing the workload without increasing staff?

• A.SIEM
• B.XDR
• C.SOAR
• D.EDR

Comment: *

Name: *

Email: *

Verification: *

A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability?

• A.Implementing multifactor authentication on the server OS
• B.Hashing user passwords on the web application
• C.Performing input validation before allowing submission
• D.Segmenting the network between the users and the web server

Comment: *

Name: *

Email: *

Verification: *

A security manager reviews the permissions for the approved users of a shared folder and finds accounts that are not on the approved access list. While investigating an incident, a user discovers data discrepancies in the file. Which of the following best describes this activity?

• A.Filesystem anomaly
• B.Illegal software
• C.Unauthorized changes
• D.Data exfiltration

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the most important reason for an incident response team to develop a formal incident declaration?

• A.To require that an incident be reported through the proper channels
• B.To identify and document staff who have the authority to declare an incident
• C.To allow for public disclosure of a security event impacting the organization
• D.To establish the department that is responsible for responding to an incident

Comment: *

Name: *

Email: *

Verification: *