312-38 practice questions 141–150

1. Question 141 · 191 in bank

   Which of the following is not part of the recommended first response steps for network defenders?

   • ARestrict yourself from doing the investigation
   • BExtract relevant data from the suspected devices as early as possible
   • CDisable virus protection
   • DDo not change the state of the suspected device

   Show answer

   Answer: B

   Explanation

   The correct answer should be B - Extract relevant data from the suspected devices as early as possible. First Responder do not do any data extraction. It is done by the forensic team. Choices A, C and D are found in the list first responser steps for network defenders (do's and don'ts) Source - Certified Network Defender (CND) Version 2 eBook w/ iLabs (Volumes 1 through 4) Page 1457 - 1464

   Source: Adapted from community discussion — Cyber_bunny

   Next question

2. Question 142 · 191 in bank

   Which among the following tools can help in identifying IoEs to evaluate human attack surface?

   • AsecuriCAD
   • BAmass
   • CSkybox
   • DSET

   Show answer

   Answer: D

   Explanation

   B. Amass Network Attack Surface: Identifying IoEs using amass — Automated Attack Surface Mapping Source: https://github.com/OWASP/Amass The OWASP Amass Project is a cybersecurity tool for gathering information on the attack surface of targets in multiple dimensions. It allows performing network mapping of the attack surface and also performs external asset discovery by collecting open-source information and using reconnaissance techniques (OSINT Reconnaissance).

   Source: Adapted from community discussion — timothybrown7

   Next question

3. Question 143 · 191 in bank

   In ______ method, event logs are arranged in the form of a circular buffer.

   • ANon-wrapping method
   • BLIFO method
   • CWrapping method
   • DFIFO method

   Show answer

   Answer: C

   Next question

4. Question 144 · 191 in bank

   Which of the following can be used to disallow a system/user from accessing all applications except a specific folder on a system?

   • AHash rule
   • BPath rule
   • CInternet zone rule
   • DCertificate rule

   Show answer

   Answer: B

   Next question

5. Question 145 · 191 in bank

   Which of the following helps prevent executing untrusted or untested programs or code from untrusted or unverified third-parties?

   • AApplication sandboxing
   • BDeployment of WAFS
   • CApplication whitelisting
   • DApplication blacklisting

   Show answer

   Answer: A

   Next question

6. Question 146 · 191 in bank

   Who is an IR custodian?

   • AAn individual responsible for conveying company details after an incident
   • BAn individual who receives the initial IR alerts and leads the IR team in all the IR activities
   • CAn individual who makes a decision on the classifications and the severity of the incident identified
   • DAn individual responsible for the remediation and resolution of the incident that occurred

   Show answer

   Answer: D

   Next question

7. Question 147 · 191 in bank

   Which among the following filter is used to detect a SYN/FIN attack?

   • Atcp.flags==0x002
   • Btcp.flags==0x004
   • Ctcp.flags==0x003
   • Dtcp.flags==0x001

   Show answer

   Answer: C

   Next question

8. Question 148 · 191 in bank

   Choose the correct order of steps to analyze the attack surface.

   • AIdentify the indicators of exposure->visualize the attack surface->simulate the attack->reduce the attack surface
   • BVisualize the attack surface->simulate the attack->identify the indicators of exposure->reduce the attack surface
   • CIdentify the indicators of exposure->simulate the attack->visualize the attack surface->reduce the attack surface
   • DVisualize the attack surface->identify the indicators of exposure->simulate the attack->reduce the attack surface

   Show answer

   Answer: D

   Next question

9. Question 149 · 191 in bank

   Leslie, the network administrator of Livewire Technologies, has been recommending multilayer inspection firewalls to deploy the company’s infrastructure. What layers of the TCP/IP model can it protect?

   • AIP, application, and network interface
   • BNetwork interface, TCP, and IP
   • CApplication, TCP, and IP
   • DApplication, IP, and network interface

   Show answer

   Answer: D

   Next question

10. Question 150 · 191 in bank

    To provide optimum security while enabling safe/necessary services, blocking known dangerous services, and making employees accountable for their online activity, what Internet Access policy would Brian, the network administrator, have to choose?

    • APrudent policy
    • BParanoid policy
    • CPromiscuous policy
    • DPermissive policy

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-38 practice, question 141. 191 questions available.