Question 121 · 334 in bank
An engineer received a flood of phishing emails from HR with the source address HRjacobrn@company.com. What is the threat actor in this scenario?
Show answer
Answer: A
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)334 questions across 34 pages are complete and free, with no account or card.
334 questions in this bank
Free access · progress saved on this device
An engineer received a flood of phishing emails from HR with the source address HRjacobrn@company.com. What is the threat actor in this scenario?
Answer: A
What is the difference between statistical detection and rule-based detection models?
Answer: B
B is correct. Statistical checks over a period of time to see if it adheres to certain trends. Rulebased just checks for this specific moment.
Source: Adapted from community discussion — Leo_Visser
How does agentless monitoring differ from agent-based monitoring?
Answer: D
Agent-based monitoring: With agent-based monitoring, software agents are installed on the monitored systems or devices. These agents collect data locally, perform filtering or preprocessing of the data, and then transmit the relevant or valuable information to the monitoring system. Agent-based monitoring allows for local processing and filtering, which can reduce network utilization by only transmitting essential data. Agentless monitoring: Agentless monitoring, on the other hand, does not require software agents to be installed on the monitored systems or devices. Instead, it relies on leveraging existing protocols and interfaces, such as APIs (Application Programming Interfaces) or SNMP (Simple Network Management Protocol), to remotely access and retrieve monitoring data from the target systems. Agentless monitoring generally involves higher network utilization as the monitoring system needs to gather data from remote systems over the network.
Source: Adapted from community discussion — Topsecret
Syslog collecting software is installed on the server. For the log containment, a disk with FAT type partition is used. An engineer determined that log files are being corrupted when the 4 GB file size is exceeded. Which action resolves the issue?
Answer: A
he FAT file system is an older file system that is not as robust as newer file systems such as NTFS. One of the limitations of FAT is that it cannot handle files larger than 4 GB in size, which is causing the log files to become corrupted. Therefore, using a different file system that can handle larger file sizes, such as NTFS, would resolve the issue.
Source: Adapted from community discussion — drdecker100
Which type of verification consists of using tools to compute the message digest of the original and copied data, then comparing the similarity of the digests?
Answer: C
What are two denial-of-service (DoS) attacks? (Choose two.)
Answer: DE
What is threat hunting?
Answer: A
According to the September 2020 threat intelligence feeds, a new malware called Egregor was introduced and used in many attacks. Distribution of Egregor is primarily through a Cobalt Strike that has been installed on victim's workstations using RDP exploits. Malware exfiltrates the victim's data to a command and control server. The data is used to force victims pay or lose it by publicly releasing it. Which type of attack is described?
Answer: C
Even if you're not familiar with Egregor, the fact that it forces victims to pay the data or lose it is a characteristic of a Ransomware.
Source: Adapted from community discussion — SecurityGuy
A company encountered a breach on its web servers using IIS 7.5. During the investigation, an engineer discovered that an attacker read and altered the data on a secure communication using TLS 1.2 and intercepted sensitive information by downgrading a connection to export-grade cryptography. The engineer must mitigate similar incidents in the future and ensure that clients and servers always negotiate with the most secure protocol versions and cryptographic parameters. Which action does the engineer recommend?
Answer: A
TLS v1.0 - Deprecated TLS v1.1 - Deprecated TLS v1.2 - In use (supported by 99.9% of the websites). TLS v1.3 - In use (supported by 59.8% of the websites), although many haven’t implemented it as the default protocol. https://cheapsslsecurity.com/blog/tls-versions-what-they-are-and-which-ones-are-still-supported/ - From a Security Admin point of view, the most obvious choice is to update software versions. Since TLS has is more inclined to security than IIS, I'd go with A on this one.
Source: Adapted from community discussion — SecurityGuy
What is the difference between discretionary access control (DAC) and role-based access control (RBAC)?
Answer: A
The answer is D. DAC is a type of access control that allows the owner of an object to define who has access to it. Permissions are applied on a user and group level. For example, the owner of a file can grant read, write, and execute permissions to the users and groups they choose. RBAC is a type of access control that defines permissions based on a user's role. Roles are assigned to users based on their job function or responsibilities. For example, a user with the role of "employee" might have read-only access to all files, while a user with the role of "manager" might have read, write, and execute permissions to all files.
Source: Adapted from community discussion — Faio
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
200-201 practice, question 121. 334 questions available.
Version 1.0.0. How we source questions