When investigating a potentially compromised host, an analyst observes that the process BGInfo.exe (PID 1024), a Sysinternals tool used to create desktop backgrounds containing host details, has bee running for over two days. Which of the following activities will provide the best insight into this potentially malicious process, based on the anomalous behavior?

• A.Changes to system environment variables
• B.SMB network traffic related to the system process
• C.Recent browser history of the primary user
• D.Activities taken by PID 1024

Comment: *

Name: *

Email: *

Verification: *

The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?

• A.A mean time to remediate of 30 days
• B.A mean time to detect of 45 days
• C.A mean time to respond of 15 days
• D.Third-party application testing

Comment: *

Name: *

Email: *

Verification: *

A SOC manager is establishing a reporting process to manage vulnerabilities. Which of the following would be the best solution to identify potential loss incurred by an issue?

• A.Trends
• B.Risk score
• C.Mitigation
• D.Prioritization

Comment: *

Name: *

Email: *

Verification: *

A threat hunter seeks to identify new persistence mechanisms installed in an organization's environment. In collecting scheduled tasks from all enterprise workstations, the following host details are aggregated:

Which of the following actions should the hunter perform first based on the details above?

• A.Acquire a copy of taskhw.exe from the impacted host
• B.Scan the enterprise to identify other systems with taskhw.exe present
• C.Perform a public search for malware reports on taskhw.exe.
• D.Change the account that runs the -caskhw. exe scheduled task

Comment: *

Name: *

Email: *

Verification: *

While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next?

• A.Shut the network down immediately and call the next person in the chain of command.
• B.Determine what attack the odd characters are indicative of
• C.Utilize the correct attack framework and determine what the incident response will consist of.
• D.Notify the local law enforcement for incident response

Comment: *

Name: *

Email: *

Verification: *