While reviewing web server logs, a security analyst found the following line:
<IMG SRC='vbscript:msgbox("test")'>
Which of the following malicious activities was attempted?

• A.Command injection
• B.XML injection
• C.Server-side request forgery
• D.Cross-site scripting

Comment: *

Name: *

Email: *

Verification: *

An attacker recently gained unauthorized access to a financial institution's database, which contains confidential information. The attacker exfiltrated a large amount of data before being detected and blocked. A security analyst needs to complete a root cause analysis to determine how the attacker was able to gain access.
Which of the following should the analyst perform first?

• A.Document the incident and any findings related to the attack for future reference.
• B.Interview employees responsible for managing the affected systems.
• C.Review the log files that record all events related to client applications and user access.
• D.Identify the immediate actions that need to be taken to contain the incident and minimize damage.

Comment: *

Name: *

Email: *

Verification: *

A network analyst notices a long spike in traffic on port 1433 between two IP addresses on opposite sides of a WAN connection. Which of the following is the most likely cause?

• A.A local red team member is enumerating the local RFC1918 segment to enumerate hosts.
• B.A threat actor has a foothold on the network and is sending out control beacons.
• C.An administrator executed a new database replication process without notifying the SOC.
• D.An insider threat actor is running Responder on the local segment, creating traffic replication.

Comment: *

Name: *

Email: *

Verification: *

A user is flagged for consistently consuming a high volume of network bandwidth over the past week. During the investigation, the security analyst finds traffic to the following websites:
Date/Time
URL
Destination Port
Bytes In
Bytes Out
12/24/2023 14:00:25
youtube.com
80
450000
4587
12/25/2023 14:09:30
translate.google.com
80
2985
3104
12/25/2023 14:10:00
tiktok.com
443
675000
105
12/25/2023 16:00:45
netflix.com
443
525900
295
12/26/2023 16:30:45
grnail.com
443
1250
525984
12/31/2023 17:30:25
office.com
443
350000
450
12/31/2023 17:35:00
youtube.com
443
300
350000
Which of the following data flows should the analyst investigate first?

• A.netflix.com
• B.youtube.com
• C.tiktok.com
• D.grnail.com
• E.translate.google.com
• F.office.com

Comment: *

Name: *

Email: *

Verification: *

Which of the following is a circumstance in which a security operations manager would most likely consider using automation?

• A.The generation of NIDS rules based on received STIX messages
• B.The fulfillment of privileged access requests to enterprise domain controllers
• C.The verification of employee identities prior to initial PKI enrollment
• D.The analysis of suspected malware binaries captured by an email gateway

Comment: *

Name: *

Email: *

Verification: *