200-201 practice questions 131–140

1. Question 131 · 334 in bank

   The SOC team has confirmed a potential indicator of compromise on an isolated endpoint. The team has narrowed the potential malware type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling the event?

   • APerform an AV scan on the infected endpoint.
   • BIsolate the infected endpoint from the network.
   • CPrioritize incident handling based on the impact.
   • DAnalyze the malware behavior.

   Show answer

   Answer: D

   Explanation

   Keyword: Isolated endpoint. Since it is already isolated, the next step would be to analyze the malware's behavior to know what files or data it infects or how it infects the victim computer.

   Source: Adapted from community discussion — SecurityGuy

   Next question

2. Question 132 · 334 in bank

   Select 2

   An engineer is working with the compliance teams to identify the data passing through the network. During analysis, the engineer informs the compliance team that external perimeter data flows contain records, writings, and artwork. Internal segregated network flows contain the customer choices by gender, addresses, and product preferences by age? The engineer must identify protected data. Which two types of data must be identified? (Choose two.)

   • ASOX
   • BPII
   • CPCI
   • DPHI
   • Ecopyright

   Show answer

   Answer: BE

   Explanation

   PHI (Protected Health Information) - The are individually identifiable health information that is transmitted or maintained in any form or medium (electronic, oral, or paper) by a covered entity or its business associates, excluding certain educational and employment records. Since there are no mentioned health information, Copyright would be the most sensible choice.

   Source: Adapted from community discussion — SecurityGuy

   Next question

3. Question 133 · 334 in bank

   What is the difference between a threat and a risk?

   • AThreat represents a potential danger that could take advantage of a weakness, while the risk is the likelihood of a compromise or damage of an asset.
   • BRisk represents the known and identified loss or danger in the system, while threat is a non-identified impact of possible risks.
   • CRisk is the unintentional possibility of damages or harm to infrastructure, while the threats are certain and intentional.
   • DThreat is a state of being exposed to an attack or a compromise, while risk is the calculation of damage or potential loss affecting the organization from an exposure.

   Show answer

   Answer: A

   Explanation

   Threat : potential danger to an asset Vulnerability : a weakness in a system could be exploited by a threat Exploit : mechanism that is used to leverage vulnerability to compromise an asset Risk : likelihood that a threat will exploit vulnerability of an asset (A)

   Source: Adapted from community discussion — hansamaru

   Next question

4. Question 134 · 334 in bank

   

   Refer to the exhibit. Which stakeholders must be involved when a company workstation is compromised?

   • AEmployee 1, Employee 2, Employee 3, Employee 4, Employee 5, Employee 7
   • BEmployee 4, Employee 6, Employee 7
   • CEmployee 1, Employee 2, Employee 4, Employee 5
   • DEmployee 2, Employee 3, Employee 4, Employee 5

   Show answer

   Answer: D

   Next question

5. Question 135 · 334 in bank

   

   Refer to the exhibit. Which field contains DNS header information if the payload is a query or response?

   • AID
   • BZ
   • CQR
   • DTC

   Show answer

   Answer: C

   Explanation

   If the payload of a DNS message is a query or response, the DNS header field that contains information about the message is the QR (Query/Response) field. The QR field is a 1-bit field in the DNS header that indicates whether the message is a query (QR=0) or a response (QR=1). The ID (Identification) field is a 16-bit field that identifies the DNS query and is used to match responses with queries. The Z (Reserved for future use) field is a 3-bit field that is currently unused and must be set to 0. The TC (Truncated) field is a 1-bit field that indicates whether a message was truncated due to size limitations.

   Source: Adapted from community discussion — drdecker100

   Next question

6. Question 136 · 334 in bank

   What is the difference between a threat and an exploit?

   • AAn exploit is an attack path, and a threat represents a potential vulnerability.
   • BAn exploit is an attack vector, and a threat is a potential path the attack must go through.
   • CA threat is a potential attack on an asset, and an exploit takes advantage of the vulnerability of the asset.
   • DA threat is a result of utilizing flow in a system, and an exploit is a result of gaining control over the system.

   Show answer

   Answer: C

   Next question

7. Question 137 · 334 in bank

   

   Refer to the exhibit. A SOC engineer is analyzing the provided Cuckoo Sandbox report for a file that has been downloaded from an URL, received via email. What is the state of this file?

   • AThe file was identified as PE32 executable for MS Windows and the Yara filed lists it as Trojan.
   • BThe file was detected as executable and was matched by PEiD threat signatures for further analysis.
   • CThe file was detected as executable, but no suspicious features are identified.
   • DThe calculated SHA256 hash of the file was matched and identified as malicious.

   Show answer

   Answer: A

   Next question

8. Question 138 · 334 in bank

   A security analyst notices a sudden surge of incoming traffic and detects unknown packets from unknown senders. After further investigation, the analyst learns that customers claim that they cannot access company servers. According to NIST SP800-61, in which phase of the incident response process is the analyst?

   • Apreparation
   • Bpost-incident activity
   • Ccontainment, eradication, and recovery
   • Ddetection and analysis

   Show answer

   Answer: D

   Explanation

   It asks which phase is the Anaylst on. Given details: - notices a sudden surge of incoming traffic - detects unknown packets from unknown senders - learns that customers claim that they cannot access company servers From the given details, the Analyst has just detected the Indicators of Compromise.

   Source: Adapted from community discussion — SecurityGuy

   Next question

9. Question 139 · 334 in bank

   An engineer is analyzing a recent breach where confidential documents were altered and stolen by the receptionist. Further analysis shows that the threat actor connected an external USB device to bypass security restrictions and steal data. The engineer could not find an external USB device. Which piece of information must an engineer use for attribution in an investigation?

   • Areceptionist and the actions performed
   • Bstolen data and its criticality assessment
   • Cexternal USB device
   • Dlist of security restrictions and privileges boundaries bypassed

   Show answer

   Answer: A

   Explanation

   The engineer must focus on identifying the individual responsible for the breach and the actions they performed. In this case, the receptionist connected an external USB device to bypass security restrictions and steal data, which resulted in the breach. Therefore, the key piece of information for attribution in the investigation is the identity of the receptionist and the actions they took. It is important to determine how the receptionist gained access to the confidential documents and if there were any vulnerabilities in the security system that allowed the breach to occur. This information can help prevent similar breaches in the future.

   Source: Adapted from community discussion — drdecker100

   Next question

10. Question 140 · 334 in bank

    How does TOR alter data content during transit?

    • AIt encrypts content and destination information over multiple layers.
    • BIt traverses source traffic through multiple destinations before reaching the receiver.
    • CIt redirects destination traffic through multiple sources avoiding traceability.
    • DIt spoofs the destination and source information protecting both sides.

    Show answer

    Answer: A

    Explanation

    TOR (The Onion Router) - It is a network that anonymizes web traffic to provide truly private web browsing. - The Tor Browser hides your IP address and browsing activity by redirecting web traffic through a series of different routers known as nodes.

    Source: Adapted from community discussion — SecurityGuy

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 131. 334 questions available.