A security analyst is reviewing the following alert that was triggered by FIM on a critical system:

Which of the following best describes the suspicious activity that is occurring?

• A.A fake antivirus program was installed by the user.
• B.A network drive was added to allow exfiltration of data
• C.A new program has been set to execute on system start
• D.The host firewall on 192.168.1.10 was disabled.

Comment: *

Name: *

Email: *

Verification: *

A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account. Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?

• A.Scan the employee's computer with virus and malware tools.
• B.Review the actions taken by the employee and the email related to the event
• C.Contact human resources and recommend the termination of the employee.
• D.Assign security awareness training to the employee involved in the incident.

Comment: *

Name: *

Email: *

Verification: *

Which of the following threat-modeling procedures is in the OWASP Web Security Testing Guide?

• A.Review Of security requirements
• B.Compliance checks
• C.Decomposing the application
• D.Security by design

Comment: *

Name: *

Email: *

Verification: *

A regulated organization experienced a security breach that exposed a list of customer names with corresponding PH dat a. Which of the following is the best reason for developing the organization's communication plans?

• A.For the organization's public relations department to have a standard notification
• B.To ensure incidents are immediately reported to a regulatory agency
• C.To automate the notification to customers who were impacted by the breach
• D.To have approval from executive leadership on when communication should occur

Comment: *

Name: *

Email: *

Verification: *

A security analyst needs to secure digital evidence related to an incident. The security analyst must ensure that the accuracy of the data cannot be repudiated. Which of the following should be implemented?

• A.Offline storage
• B.Evidence collection
• C.Integrity validation
• D.Legal hold

Comment: *

Name: *

Email: *

Verification: *