A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?

• A.function w() { info=$(ping -c 1 $1 | awk -F "/" 'END{print $1}') && echo "$1 | $info" }
• B.function x() { info=$(geoiplookup $1) && echo "$1 | $info" }
• C.function y() { info=$(dig -x $1 | grep PTR | tail -n 1 ) && echo "$1 | $info" }
• D.function z() { info=$(traceroute -m 40 $1 | awk 'END{print $1}') && echo "$1 | $info" }

Comment: *

Name: *

Email: *

Verification: *

An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe?

• A.Eradication
• B.Recovery
• C.Containment
• D.Preparation

Comment: *

Name: *

Email: *

Verification: *

A security analyst discovers an ongoing ransomware attack while investigating a phishing email. The analyst downloads a copy of the file from the email and isolates the affected workstation from the network. Which of the following activities should the analyst perform next?

• A.Wipe the computer and reinstall software
• B.Shut down the email server and quarantine it from the network.
• C.Acquire a bit-level image of the affected workstation.
• D.Search for other mail users who have received the same file.

Comment: *

Name: *

Email: *

Verification: *

Two employees in the finance department installed a freeware application that contained embedded malware.
The network is robustly segmented based on areas of responsibility. These computers had critical sensitive information stored locally that needs to be recovered. The department manager advised all department employees to turn off their computers until the security team could be contacted about the issue. Which of the following is the first step the incident response staff members should take when they arrive?

• A.Turn on all systems, scan for infection, and back up data to a USB storage device.
• B.Identify and remove the software installed on the impacted systems in the department.
• C.Explain that malware cannot truly be removed and then reimage the devices.
• D.Log on to the impacted systems with an administrator account that has privileges to perform backups.
• E.Segment the entire department from the network and review each computer offline.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is a nation-state actor least likely to be concerned with?

• A.Detection by MITRE ATT&CK framework.
• B.Detection or prevention of reconnaissance activities.
• C.Examination of its actions and objectives.
• D.Forensic analysis for legal action of the actions taken

Comment: *

Name: *

Email: *

Verification: *