Refer to the exhibit. We have performed a malware detection on the Cisco website. Which statement about the result is true? A.The website has been marked benign on all 68 checks.B.The threat detection needs to run again.C.The website has 68 open threats.D.The website has been marked benign on 0 checks.
Correct answer: A
During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity? A.collectionB.examinationC.reportingD.investigation
Correct answer: A
Refer to the exhibit. A customer reports that they cannot access your organization's website. Which option is a possible reason that the customer cannot access the website? A.The server at 10.33.1.5 is using up too much bandwidth causing a denial-of-service.B.The server at 10.67.10.5 has a virus.C.A vulnerability scanner has shown that 10.67.10.5 has been compromised.D.Web traffic sent from 10.67.10.5 has been identified as malicious by Internet sensors.
Correct answer: D
You see 100 HTTP GET and POST requests for various pages on one of your webservers. The user agent in the requests contain php code that, if executed, creates and writes to a new php file on the webserver. Which category does this event fall under as defined in the Diamond Model of Intrusion? A.deliveryB.reconnaissanceC.action on objectivesD.installationE.exploitation
Correct answer: D
A security analyst is reviewing a vulnerability assessment report. One critical vulnerability has a CVSS v3.0 base score of 9.8. The vector string is: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the characteristics of this vulnerability based on the vector?
Correct answer: B
The vector components decode as follows: AV:N (Attack Vector: Network), AC:L (Attack Complexity: Low), PR:N (Privileges Required: None), UI:N (User Interaction: None). This indicates a remotely exploitable vulnerability that requires no authentication or user action, making it critical.
During a forensic investigation of a compromised Windows workstation, an analyst suspects the attacker established persistence using the Registry. Which TWO Registry keys are most commonly modified to execute malware automatically upon user login? (Select TWO)
Correct answers: A, C
The 'Run' keys in both HKCU (Current User) and HKLM (Local Machine) are standard locations for auto-start entries. Malware often adds values here to ensure execution when a user logs in.
The 'RunOnce' key is another mechanism for persistence, allowing a program to run the next time the system boots or a user logs on, often used by malware to complete installation or re-infect.
True or False: In the context of digital forensics, the 'Order of Volatility' dictates that you should capture data from a hard disk drive before capturing data from the CPU cache and registers.
Correct answer: B
False. The Order of Volatility states that you must capture the most volatile data first. CPU cache and registers are the most volatile, followed by RAM, then temporary file systems, and finally non-volatile storage like hard disks.
A SOC analyst is analyzing a Linux server that was compromised. The attacker attempted to delete log files to cover their tracks. Which feature of the Ext4 file system might allow the analyst to recover or reconstruct the timeline of file operations even after deletion?
Correct answer: B
Ext4 is a journaling file system. The journal keeps a log of changes that are about to be made to the main file system. Even if files are deleted, the journal entries may persist for a time, allowing forensic analysts to recover metadata or file contents and reconstruct the timeline.
Register free to unlock 9 more sample questions
Own this practice test forever.
Any 2 exams per month.
Any 4 exams per month.
Any 12 exams over 3 months.
