Question 1

The SOC team has confirmed a potential indicator of compromise on an isolated endpoint. The team has narrowed the potential malware type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling the event?

Options :

A : Perform an AV scan on the infected endpoint.

B : Isolate the infected endpoint from the network.

C : Prioritize incident handling based on the impact.

D : Analyze the malware behavior.

Answer: D

Question 2

An engineer must investigate suspicious connections. Data has been gathered using a tcpdump command on a Linux device and saved as sandboxmalware2022-12-22.pcaps file. The engineer is trying to open the tcpdump in the Wireshark tool. What is the expected result?

Options :

A : The file is opened.

B : The tool does not support Linux.

C : The file does not support the “-“ character.

D : The file has an incorrect extension.

Answer: A

Question 3

Which artifact is used to uniquely identify a detected file?

Options :

A : file timestamp

B : file extension

C : file size

D : file hash

Answer: D

Question 4

What is the difference between a threat and a risk?

Options :

A : Threat represents a potential danger that could take advantage of a weakness in a system

B : Risk represents the known and identified loss or danger in the system

C : Risk represents the nonintentional interaction with uncertainty in the system

D : Threat represents a state of being exposed to an attack or a compromise, either physically or logically.

Answer: A

Question 5

Refer to the exhibit.

What must be interpreted from this packet capture?

Options :

A : IP address 192.168.88 12 is communicating with 192 168 88 149 with a source port 74 to destination port 49098 using TCP protocol

B : IP address 192.168.88.12 is communicating with 192 168 88 149 with a source port 49098 to destination port 80 using TCP protocol.

C : IP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to destination port 49098 using TCP protocol.

D : IP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to destination port 80 using TCP protocol.

Answer: B

Higher Test Marks with Free Online 200-201 Exam Practice

Buying Options: