QUESTION 38
Which of the following attack can be eradicated by disabling of “allow_url_fopen and allow_url_include” in the php.ini file?

QUESTION 39
Emmanuel is working as a SOC analyst in a company named Tobey Tech. The manager of Tobey Tech recently recruited an Incident Response Team (IRT) for his company. In the process of collaboration with the IRT, Emmanuel just escalated an incident to the IRT.
What is the first step that the IRT will do to the incident escalated by Emmanuel?

QUESTION 40
Where will you find the reputation IP database, if you want to monitor traffic from known bad IP reputation using OSSIM SIEM?

QUESTION 41
Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an incident to her for further investigation and confirmation. Charline, after a thorough investigation, confirmed the incident and assigned it with an initial priority.
What would be her next action according to the SOC workflow?

QUESTION 42
Which of the following command is used to enable logging in iptables?

QUESTION 43
What does Windows event ID 4740 indicate?

QUESTION 44
Which of the following event detection techniques uses User and Entity Behavior Analytics (UEBA)?

QUESTION 45
Which of the following formula is used to calculate the EPS of the organization?

QUESTION 46
Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.

QUESTION 47
Harley is working as a SOC analyst with Powell Tech. Powell Inc. is using Internet Information Service (IIS) version 7.0 to host their website.
Where will Harley find the web server logs, if he wants to investigate them for any anomalies?

QUESTION 48
Which of the following formula represents the risk?

QUESTION 49
Which of the following attack can be eradicated by using a safe API to avoid the use of the interpreter entirely?

QUESTION 50
Which of the following technique involves scanning the headers of IP packets leaving a network to make sure that the unauthorized or malicious traffic never leaves the internal network?

QUESTION 51
In which phase of Lockheed Martin’s – Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?

QUESTION 52
Which of the following attack can be eradicated by disabling of “allow_url_fopen and allow_url_include” in the php.ini file?