cysa

Which of the following are examples of circle of trust members for an Incident Response:

Which of the following is true about Advanced Persistent Threats?

How does an attacker attempt to carry out an integer buffer overflow attack?

When executing a scan, which of the following is considered a best practice:

What is the best way to keep SIEM and EDR rules and configurations up to date?

Which logical network architecture provides a secure tunnel between two endpoints? 

Allowing access to a record that bypasses authentication by using a direct record ID is what type of vulnerability?  

Unauthorized access is a symptom of compromise in what type of threat?

What agreement with your cloud service provider may prohibit you from scanning your cloud assets? 

Amazon Lambda is an example of what architecture? 

When code is in development, what is done in the vulnerablity review?

Which of the following is a principle of forensics?

Which of the following is a network-related symptom of compromise?

What does the default /var/log directory hold?

What term refers to a programmable chip that supports the ability to be modified in the field?  

Which authentication attack type spreads out repeated login attempts across different computers on a network? 

Which cloud assessment tool would be the best choice for a Google Cloud environment? 

Out of memory alerts are symptoms of compromise in which type of attack?

What term describes intelligence sources that are only available to an organization’s internal personnel?

Which of the Web application scanners in this section requires the most manual intervention? 

Which risks should get the most attention? 

What threat modeling technique was developed by Microsoft? 

What policy defines when data should be deleted? 

Geoblocking is one approach to which type of access control? 

What report results in a prioritized list of the most important and vulnerable critical business functions? 

What is the most common data query language? 

Which term refers to malware that operates exclusively in memory? 

In the verification phase, an audit is used to do what?

Which of the following is an indicator of compromise?

How does threat hunting differ from most other security activities? 

Within a IR team, communication needs to be:

What does NGFW stand for?

What is hashcat used for?

When controlling a crime scene, it is important to consider:

What is an effective way to prevent a mobile device held as evidence from being remotely wiped? 

What is a common command-line utility used to build HTTP requests to invoke remote functions via APIs? 

What common data structure makes it easy to define permissions in the Windows operating system? 

The risk evaluation process is a review process of which of the following:

Which hardware tampering technique can be thwarted by random signals resulting in voltage applied to chips

What NIST protocol defines modules that dictate compliance requirements and settings? 

Which type of threat actor commonly has access to the greatest funding and uses the most sophisticated attacks?

Which type of threat hunting hypothesis is based on lessons learned from previous hunts? 

What type of threat research can you carry out using VirusTotal?

A framework is often described as which of the following:

What e-mail attack attempts to trick users into clicking links that refer to an attacker’s resource? 

What is Little Snitch?

Logins from various locations around the world that don't match with a company's internal policies are an IOC because:

What is a common open source IPS that makes it easy to build rules to detect and prevent intrusions? 

Which cryptographic technique uses a pair of keys, one to encrypt data and the other to decrypt data? 

ArcSight, Qradar, Splunk, Alienvault, OSSIMKiwi Syslog, & ELK are all examples of:

Which type of system may contain vulnerabilities due to the autonomous operation of remote facilities? 

What does the security of encrypted data most depend on? 

What does OWASP stand for?

Splunk Phantom is what type of security tool? 

Which access method defines object classifications and user clearances? 

What tool is commonly used in mapping and enumeration?

How do you determine which vulnerability to mitigate first? 

What is the first step in the Intelligence Cycle? 

What resource is a community-driven effort that provides a wide variety of hardening guides and configuration baselines?

What is the origin of the encryption key for SED? 

Communication between a host that might be compromised on the network & an external controller is called:

Which European Union regulation protects individual data privacy? 

What are some of the key elements to a good incident response plan?

What are the two most popular types of attacks on physical access systems? 

Which active scanner is a supercharged version of a simple network utility that allows you to craft custom packets? 

Which response category describes a reported insecure Web server that wasn’t actually present in your network?

What policy specifies whether it is okay to access Facebook from a work computer? 

What is a common method used to limit malicious data leakage? 

What is a botnet? 

What are the 3 categories of controls?

Which tool can be used on wired and wireless environments to crack passwords? 

What technique uses anonymized responses from subject matter experts to assess risk? 

Why should default user accounts be deleted after installing software? 

A Cisco firewall is what type of firewall? 

Which approach to scanning reduces network traffic?

A SIEM is useful because provides which of the following:

Which cloud service model provides the operating system and even databases, but no applications? 

How does a machine learning algorithm “learn”? 

Which of the following best describes hacktivism?

Unexpected outbound transmissions are difficult to detect because:

Which of the following is an appropriate method to protect your network assets:

Which of the following is included in the development phase of the SDLC?

Which attack framework is based on the military’s F2T2EA? 

After securing the crime scene, why is seizure the first step in a forensic investigation?

What is the main purpose of impact analysis? 

Which application software layer most likely interacts directly with an enterprise database to create summary reports? 

What term refers to the feature that avoids firmware overwrite failures that result in unbootable devices? 

Which early remote service call method uses XML over HTTP? 

A well-defined scan will help with determining which of the following: