SIMULATION
An organization's website was maliciously altered.
INSTRUCTIONS
Review information in each tab to select the source IP the analyst should be concerned about, the indicator of compromise, and the two appropriate corrective actions.

Correct Answer:

see the explanation for step by step solution.
Explanation:
Step 1: Analyzing the SFTP Log
The SFTP log provides a record of file transfer and login activities:
User "sjames" logged in from several IP addresses:
192.168.10.32 and 192.168.10.37 (internal network IPs)
32.111.16.37 and 41.21.18.102 (external IPs)
We see file alterations in the /var/www directory, which is commonly the web directory.
Modified files: about_us.html, index.html
Suspicious activity:
192.168.11.102 and 41.21.18.102 modified the files.
32.111.16.37 had failed login attempts, indicating possible unauthorized access attempts.
The most suspicious IP here is 41.21.18.102, as it's associated with direct file modifications, possibly indicating unauthorized access.
Step 2: Reviewing Netstat
The netstat output shows active connections and their states:
IP 41.21.18.102 has an ESTABLISHED connection with port 22, commonly used for SFTP.
IP 32.111.16.37 is also attempting connections, and 32.111.16.37 connections are in a TIME_WAIT state, showing prior connections were recently closed.
The netstat output reaffirms 41.21.18.102 is actively connected and potentially involved in malicious activities.
Step 3: Checking the HTTP Access Log
The HTTP Access log shows access to about_us.html:
32.111.16.37 repeatedly accessed /about_us.html with 404 errors, indicating attempts to reach non-existing pages.
41.21.18.102 accessed the 200 status code, showing successful page requests, but since this IP was modifying files directly on the server, it might be testing or verifying changes.
Again, 41.21.18.102 stands out as it matches both successful file modification and page request patterns, while 32.111.16.37 shows unsuccessful attempts.
Step 4: Selecting the IP of Concern
Based on the above analysis:
Step 5: Identifying the Indicator of Compromise
Potential indicators include unauthorized file modifications:
Modified index.html file is the correct answer, as it indicates direct changes to website content and is often a clear sign of compromise.
Step 6: Selecting Corrective Actions
To mitigate and prevent further compromise:
Change the password on the "sjames" account: The account was used across various IPs, indicating potential account compromise.
Block external SFTP access: Restricting SFTP to internal IPs only would prevent unauthorized external modifications. Since 41.21.18.102 was external, this would stop similar threats.
Summary
IP of Concern: 41.21.18.102
Indicator of Compromise: Modified index.html file
Corrective Actions:
Change the password on the sjames account
Block external SFTP access
These selections address both the immediate security breach and implement a preventative measure against future unauthorized access.

Comment: *

Name: *

Email: *

Verification: *

New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy?

• A.Human resources must email a copy of a user agreement to all new employees
• B.Supervisors must get verbal confirmation from new employees indicating they have read the user agreement
• C.All new employees must take a test about the company security policy during the cjitoardmg process
• D.All new employees must sign a user agreement to acknowledge the company security policy

Comment: *

Name: *

Email: *

Verification: *

An organization enabled a SIEM rule to send an alert to a security analyst distribution list when ten failed logins occur within one minute. However, the control was unable to detect an attack with nine failed logins. Which of the following best represents what occurred?

• A.False positive
• B.True negative
• C.False negative
• D.True positive

Comment: *

Name: *

Email: *

Verification: *

An incident response team is working with law enforcement to investigate an active web server compromise. The decision has been made to keep the server running and to implement compensating controls for a period of time. The web service must be accessible from the internet via the reverse proxy and must connect to a database server. Which of the following compensating controls will help contain the adversary while meeting the other requirements? (Select two).

• A.Drop the tables on the database server to prevent data exfiltration.
• B.Deploy EDR on the web server and the database server to reduce the adversaries capabilities.
• C.Stop the httpd service on the web server so that the adversary can not use web exploits
• D.use micro segmentation to restrict connectivity to/from the web and database servers.
• E.Comment out the HTTP account in the / etc/passwd file of the web server
• F.Move the database from the database server to the web server.

Comment: *

Name: *

Email: *

Verification: *

An analyst is investigating a phishing incident and has retrieved the following as part of the investigation:
cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -EncodedCommand <VERY LONG STRING> Which of the following should the analyst use to gather more information about the purpose of this command?

• A.Echo the command payload content into 'base64 -d'.
• B.Execute the command from a Windows VM.
• C.Use a command console with administrator privileges to execute the code.
• D.Run the command as an unprivileged user from the analyst workstation.

Comment: *

Name: *

Email: *

Verification: *