Which of the following techniques can help a SOC team to reduce the number of alerts related to the internal security activities that the analysts have to triage?

• A.Schedule a task to disable alerting when vulnerability scans are executing.
• B.Filter all alarms in the SIEM with low severity.
• C.Enrich the SIEM-ingested data to include all data required for triage.
• D.Add a SOAR rule to drop irrelevant and duplicated notifications.

Comment: *

Name: *

Email: *

Verification: *

An analyst reviews the following web server log entries:
%2E%2E/%2E%2E/%2ES2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd
No attacks or malicious attempts have been discovered. Which of the following most likely describes what took place?

• A.A SQL injection query took place to gather information from a sensitive file.
• B.A PHP injection was leveraged to ensure that the sensitive file could be accessed.
• C.Base64 was used to prevent the IPS from detecting the fully encoded string.
• D.Directory traversal was performed to obtain a sensitive file for further reconnaissance.

Comment: *

Name: *

Email: *

Verification: *

A systems administrator notices unfamiliar directory names on a production server. The administrator reviews the directory listings and files, and then concludes the server has been compromised. Which of the following steps should the administrator take next?

• A.Inform the internal incident response team.
• B.Follow the company's incident response plan.
• C.Review the lessons learned for the best approach.
• D.Determine when the access started.

Comment: *

Name: *

Email: *

Verification: *

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

• A.Deploy a CASB and enable policy enforcement
• B.Configure MFA with strict access
• C.Deploy an API gateway
• D.Enable SSO to the cloud applications

Comment: *

Name: *

Email: *

Verification: *

A company patches its servers using automation software. Remote SSH or RDP connections are allowed to the servers only from the service account used by the automation software. All servers are in an internal subnet without direct access to or from the internet. An analyst reviews the following vulnerability summary:

Which of the following vulnerability IDs should the analyst address first?

• A.1
• B.2
• C.3
• D.4

Comment: *

Name: *

Email: *

Verification: *