CySa+ 003

What is a common command-line utility used to build HTTP requests to invoke remote functions via APIs? 

ArcSight, Qradar, Splunk, Alienvault, OSSIMKiwi Syslog, & ELK are all examples of:

Within a IR team, communication needs to be:

What is an effective way to prevent a mobile device held as evidence from being remotely wiped? 

What are the two most popular types of attacks on physical access systems? 

Which of the Web application scanners in this section requires the most manual intervention? 

How do you determine which vulnerability to mitigate first? 

What report results in a prioritized list of the most important and vulnerable critical business functions? 

What is Little Snitch?

What term describes intelligence sources that are only available to an organization’s internal personnel?

What is the best way to keep SIEM and EDR rules and configurations up to date?

How does a machine learning algorithm “learn”? 

Which cloud assessment tool would be the best choice for a Google Cloud environment? 

When controlling a crime scene, it is important to consider:

Which term refers to malware that operates exclusively in memory? 

How does threat hunting differ from most other security activities? 

Which type of threat hunting hypothesis is based on lessons learned from previous hunts? 

Splunk Phantom is what type of security tool? 

What term refers to the feature that avoids firmware overwrite failures that result in unbootable devices? 

How does an attacker attempt to carry out an integer buffer overflow attack?

What policy specifies whether it is okay to access Facebook from a work computer? 

What type of threat research can you carry out using VirusTotal?

Which response category describes a reported insecure Web server that wasn’t actually present in your network?

What does the security of encrypted data most depend on? 

What is the origin of the encryption key for SED? 

A SIEM is useful because provides which of the following:

What is hashcat used for?

Allowing access to a record that bypasses authentication by using a direct record ID is what type of vulnerability?  

Which access method defines object classifications and user clearances? 

What term refers to a programmable chip that supports the ability to be modified in the field?  

Logins from various locations around the world that don't match with a company's internal policies are an IOC because:

Unauthorized access is a symptom of compromise in what type of threat?

What does NGFW stand for?

What policy defines when data should be deleted? 

Amazon Lambda is an example of what architecture? 

Which of the following are examples of circle of trust members for an Incident Response:

Which cryptographic technique uses a pair of keys, one to encrypt data and the other to decrypt data? 

Which logical network architecture provides a secure tunnel between two endpoints? 

When executing a scan, which of the following is considered a best practice:

Which authentication attack type spreads out repeated login attempts across different computers on a network? 

Which of the following is a principle of forensics?

Why should default user accounts be deleted after installing software? 

After securing the crime scene, why is seizure the first step in a forensic investigation?

Which application software layer most likely interacts directly with an enterprise database to create summary reports? 

Which of the following is included in the development phase of the SDLC?

What tool is commonly used in mapping and enumeration?

The risk evaluation process is a review process of which of the following:

What is a common open source IPS that makes it easy to build rules to detect and prevent intrusions? 

Which type of threat actor commonly has access to the greatest funding and uses the most sophisticated attacks?

A well-defined scan will help with determining which of the following:

What is the most common data query language? 

Which of the following is true about Advanced Persistent Threats?

What does the default /var/log directory hold?

Communication between a host that might be compromised on the network & an external controller is called:

Geoblocking is one approach to which type of access control? 

What resource is a community-driven effort that provides a wide variety of hardening guides and configuration baselines?

Unexpected outbound transmissions are difficult to detect because:

When code is in development, what is done in the vulnerablity review?

What technique uses anonymized responses from subject matter experts to assess risk? 

What is a common method used to limit malicious data leakage? 

What is the main purpose of impact analysis? 

What are some of the key elements to a good incident response plan?

A Cisco firewall is what type of firewall? 

A framework is often described as which of the following:

Out of memory alerts are symptoms of compromise in which type of attack?

Which active scanner is a supercharged version of a simple network utility that allows you to craft custom packets? 

Which approach to scanning reduces network traffic?

What are the 3 categories of controls?

In the verification phase, an audit is used to do what?

Which cloud service model provides the operating system and even databases, but no applications? 

What does OWASP stand for?

What e-mail attack attempts to trick users into clicking links that refer to an attacker’s resource? 

Which hardware tampering technique can be thwarted by random signals resulting in voltage applied to chips

Which of the following best describes hacktivism?

Which of the following is an appropriate method to protect your network assets:

Which early remote service call method uses XML over HTTP? 

What is a botnet? 

What agreement with your cloud service provider may prohibit you from scanning your cloud assets? 

Which type of system may contain vulnerabilities due to the autonomous operation of remote facilities? 

What threat modeling technique was developed by Microsoft? 

What common data structure makes it easy to define permissions in the Windows operating system? 

Which risks should get the most attention? 

What NIST protocol defines modules that dictate compliance requirements and settings? 

Which European Union regulation protects individual data privacy? 

Which of the following is a network-related symptom of compromise?

Which attack framework is based on the military’s F2T2EA? 

What is the first step in the Intelligence Cycle? 

Which tool can be used on wired and wireless environments to crack passwords? 

Which of the following is an indicator of compromise?