Ch12 Sec Pro

What is the most important element related to evidence in addition to the evidence itself?

Chain of custody document

The chain of custody is used for which purpose?

Listing people coming into contact with the evidence

Your disaster recovery plan calls for backup media to be stored at a different location. The location is a safe deposit box at the local bank. Because of this, the disaster recovery plan specifies that you choose a method that uses the least amount of backup media, but also allows you to quickly back up and restore files. Which backup strategy would BEST meet the disaster recovery plan?

Perform a full backup once per week and a differential backup the other days of the week.

You would like to enhance your incident-response process and automate as much of it as possible. Which of the following elements would you need to include? (Select two.)

Playbooks Runbooks

!= or <> refers to Not Equal in which scripting language?

Python

Over the past few days, a server has gone offline and rebooted automatically several times. You would like to see a record of when each of these restarts has occurred. Which log type should you check?

System

You would like to simulate an attack on your network so you can test defense equipment and discover vulnerabilities in order to mitigate risk. Which tool would you use to simulate all the packets of an attack?

TCPReplay

What is the purpose of audit trails?

To detect security-violating events.

You are concerned that an attacker can gain access to your web server, make modifications to the system, and alter the log files to hide his or her actions. Which of the following actions would best protect the log files?

Use syslog to send log entries to another server.

This application endpoint-protection rule implicitly denies unless added to the rule. Which of the following processes describes this?

Whitelisting

You are worried about email spoofing. What can be put throughout an email's header that provides the originating email account or IP address and not a spoofed one?

X-headers

You would like to add some entries into the system log file. Which command would you use?

logger

Your network performs a full backup every night. Each Sunday, the previous night's backup tape is archived. On a Wednesday morning, the storage system fails. How many restore operations would you need to perform to recover all of the data?

1

A forensic investigator gathers potential evidence from many software, hardware, and other sources. There is an order in which the evidence needs to be gathered. The order of volatility describes the process of capturing data based on the volatility of said data. Place the following items in the correct order of volatility in the gathering of potential evidence.

1-Random Access Memory (RAM) 2-Swap/page file 3-Hard drive 4-Remote logs 5-Archived data

Which of the following describes a system image backup? (Select two.)

A system image contains everything on the system volume, including the operating system, installed programs, drivers, and user data files. A system image backup consists of an entire volume backed up to .vhd files.

Which of the following components are the SIEM's way of letting the IT team know that a pre-established parameter is not within the acceptable range?

Alerts

Some users report that frequent system crashes have started happening on their workstations. Upon further investigation, you notice that these users all have the same application installed that has been recently updated. Where would you go to conduct a root cause analysis?

Application log

Which of the following is an important aspect of evidence-gathering?

Back up all log files and audit trails.

Which of the following is true of an incremental backup's process?

Backs up all files with the archive bit set and resets the archive bit.

For source-initiated subscriptions, which tool do you use to configure event forwarding?

Group Policy

Which method can you use to verify that a bit-level image copy of a hard drive is an exact clone of the original hard drive collected as evidence?

Hashing

You have been asked to deploy a network solution that includes an alternate location where operational recovery is provided within minutes of a disaster. Which of the following strategies would you choose?

Hot site

A conditional statement that selects the statements to run depending on whether an expression is true or false is known as which of the following?

If else statement

You have a large number of source computers in your IT environment. Which subscription type would be most efficient to employ?

Source-initiated

Why should backup media be stored offsite?

To prevent the same disaster from affecting both the network and the backup media

Your browser has blocked your from your crucial secure intranet sites. What could be the problem?

Your SSL certificate status has been revoked.

You need to find the text string New Haven in 100 documents in a folder structure on a Linux server. Which command would you use?

grep

After an intrusion has occurred and the intruder has been removed from the system, which of the following is the best step or action to take next?

Back up all logs and audits regarding the incident.

You are in charge of making sure the IT systems of your company survive in case of any type of disaster in any of your locations. Your document should include organizational charts, phone lists, and order of restore. Each business unit should write their own policies and procedures with guidelines from corporate management. Which of the following documents should you create for this purpose?

Business continuity plan

You have been asked to draft a document related to evidence-gathering that contains details about personnel in possession and control of evidence from the time of discovery up through the time of presentation in court. Which type of document is this?

Chain of custody

Which of the following network strategies connects multiple servers together so that if one server fails, the others immediately take over its tasks, preventing a disruption in service?

Clustering

Which of the following is a recovery site that may have electricity connected, but there are no servers installed and no high-speed data lines present?

Cold site

You are configuring a source-initiated subscription on the collector computer in Event Viewer. Which of the following do you need to specify?

Computer group

You want to store your computer-generated audit logs in case they are needed in the future for examination or to be used as evidence in the event of a security incident. Which method can you use to ensure that the logs you put in storage have not been altered when you use them in the future?

Create a hash of each log.

You suspect cache poisoning or spoofing has occurred on your network. Users are complaining of strange web results and being redirected to undesirable sites. Which log would help you determine what is going on?

DNS logs

You have a computer with three hard disks. A RAID 0 volume uses space on Disk 1 and Disk 2. A RAID 1 volume uses space on Disk 2 and Disk 3. Disk 2 fails. Which of the following is true?

Data on the RAID 1 volume is accessible; data on the RAID 0 volume is not.

Which of the following BEST describes a constant?

Data or a value that does not change.

You set up Event Subscription, but you are getting an overwhelming amount of events recorded. What should you do?

Define a filter

You are conducting a forensic investigation. The attack has been stopped. Which of the following actions should you perform first?

Document what is on the screen.

You want to allow RDP 3389 traffic into your network for a group of users to access a particular workstation that has a special application in your office. Which endpoint security tool would you use to make this happen?

Firewall rules

You need to limit a compromised application from causing harm to other assets in your network. Which strategy should you employ?

Isolation

As a security analyst, you suspect a threat actor used a certain tactic and technique to infiltrate your network. Which incident-response framework or approach would you utilize to see if other companies have had the same occurrence and what they did to remedy it?

Mitre Att@ck

You need to remotely wipe an android phone for one of your rogue users. Which endpoint tool would you use?

Mobile device management (MDM)

Which of the following are backed up during an incremental backup?

Only files that have changed since the last full or incremental backup.

Which of the following BEST describes PuTTy?

Open-source software that is developed and supported by a group of volunteers.

What does the hashing of log files provide?

Proof that the files have not been altered

You need to limit the impact of a security breach for a particular file server with sensitive company data. Which strategy would you employ?

Segmentation

Which two types of service accounts must you use to set up event subscriptions?

Specific user service account Default machine account

Which of the following are required to configure Event Subscription for event forwarding? (Select three.)

Start Windows Event Collector service on collector computer. Start Windows Remote Management service on both the source and collector computers. Create a Windows firewall exception for HTTP or HTTPS on all source computers.

Which of the following is a standard for sending log messages to a central logging server?

Syslog

What is the best definition of a security incident?

Violation of a security policy

Daily backups are completed at the ABD company location, and only a weekly backup is maintained at another network location. Which of the following disaster recovery strategies is ABD using?

Warm site

Which log file type is one of the most tedious to parse but can tell you exactly when users log onto your site and what their location is?

Web server logs

For some reason, when you capture packets as part of your monitoring, you aren't seeing much traffic. What could be the reason?

You forgot to turn on promiscuous mode for the network interface.

You would like to see only the last 15 lines of /home/user/logfile on your Linux machine. Which command line interface (CLI) command would you use?

tail -n 15 /home/user/logfile

Your network uses the following backup strategy: Full backups every Sunday night Differential backups Monday night through Saturday night On Thursday morning, the storage system fails. How many restore operations would you need to perform to recover all of the data?

2

You have been asked to implement a RAID 5 solution for your network. What is the minimum number of hard disks that can be used to configure RAID 5?

3

Your network uses the following backup strategy: Full backups every Sunday night Incremental backups Monday night through Saturday night On a Thursday morning, the storage system fails. How many restore operations would you need to perform to recover all of the data?

4

You have detected and identified a security event. What's the first step you should complete?

Containment

You would like to make sure users are not accessing inappropriate content online at work. Which endpoint security strategy would you employ?

Content filtering

How can a criminal investigator ensure the integrity of a removable media device found while collecting evidence?

Create a checksum using a hashing algorithm

During a recent site survey, you found a rogue wireless access point on your network. Which of the following actions should you take first to protect your network while still preserving evidence?

Disconnect the access point from the network.

When you conduct a forensic investigation, which of the following initial actions is appropriate for preserving evidence?

Document what is on the screen.

You suspect a bad video driver is causing a user's system to randomly crash and reboot. Where would you go to identify and confirm your suspicions?

Dump files

You would like to get a feel for the amount of bandwidth you are using in your network. What is the first thing you should do?

Establish a baseline.

You wish to configure collector-initiated event subscriptions. On the collector computer, in which program do you configure a subscription?

Event Viewer

By default, events received from the source computers in Event Subscription are saved in which log?

Forwarded Events log

Which backup strategy backs up all files from a computer's file system, regardless of whether the file's archive bit is set or not, and then marks them as backed up?

Full

Your company is about to begin litigation, and you need to gather information. You need to get emails, memos, invoices, and other electronic documents from employees. You'd also like to get printed, physical copies of documents. Which tool would you use to gather this information?

Legal hold

Match each network sniffing method with the correct definition.

MAC spoofing - Allows an attacker's computer to connect to a switch using an authorized MAC address. MAC flooding - The process of intentionally overwhelming the CAM table with Ethernet frames, each originating from a different MAC address. ARP poisoning - The MAC address of the attacker can be associated with the IP address of another host. Port mirroring - Creates a duplicate of all network traffic on a port and sends it to another device.

As a security analyst, you are configuring your environment to be able to properly gather digital forensic information. Which of the following must be set up to help create a timeline of events?

Make sure all client computers have their time set accurately by a time server.

As a security analyst, you have discovered the victims of an malicious attack have several things in common. Which tools would you use to help you identify who might be behind the attacks and prevent potential future victims?

Mitre Att@cks Diamond Model of Intrusion Analysis

To prevent server downtime, which of the following components should be installed redundantly in a server system?

Power supply

Which of the following disk configurations might sustain losing two disks? (Select two.)

RAID 1+0 RAID 0+1

Which of the following drive configurations is fault tolerant?

RAID 5

What is the primary security feature that can be designed into a network's infrastructure to protect and support availability?

Redundancy

A system failure has occurred. Which of the following restoration processes would result in the fastest restoration of all data to its most current state?

Restore the full backup and the last differential backup

You want to set up a collector-initiated environment for event subscriptions. Which commands would you run? (Select two.)

Run wecuitl qc on the collector computer. Run winrum qc -q on the source computer.

For some reason, your source computers are not communicating properly with the collector. Which tool would you use to verify communications?

Runtime Status

As a security analyst, you are looking for a platform to compile all your security data generated by different endpoints. Which tool would you use?

SOAR