QUESTION 45
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.

QUESTION 46
What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

QUESTION 47
An analyst received an alert on their desktop computer showing that an attack was successful on the host.
After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

QUESTION 48
Which artifact is used to uniquely identify a detected file?

QUESTION 49
Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

QUESTION 50
An analyst received an alert on their desktop computer showing that an attack was successful on the host.
After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

QUESTION 51
The security team has detected an ongoing spam campaign targeting the organization. The team’s approach is to push back the cyber kill chain and mitigate ongoing incidents. At which phase of the cyber kill chain should the security team mitigate this type of attack?

QUESTION 52
Refer to the exhibit.

An analyst received this alert from the Cisco ASA device, and numerous activity logs were produced. How should this type of evidence be categorized?

QUESTION 53
Refer to the exhibit.

During the analysis of a suspicious scanning activity incident, an analyst discovered multiple local TCP connection events Which technology provided these logs?

QUESTION 54
A company is using several network applications that require high availability and responsiveness, such that milliseconds of latency on network traffic is not acceptable. An engineer needs to analyze the network and identify ways to improve traffic movement to minimize delays. Which information must the engineer obtain for this analysis?

QUESTION 55
Which category relates to improper use or disclosure of PII data?

QUESTION 56

Refer to the exhibit. An attacker scanned the server using Nmap. What did the attacker obtain from this scan?

QUESTION 57
Refer to the exhibit.

Which two elements in the table are parts of the 5-tuple? (Choose two.)

QUESTION 58
Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?

QUESTION 59
Which information must an organization use to understand the threats currently targeting the organization?

QUESTION 60
Refer to the exhibit.

Which packet contains a file that is extractable within Wireshark?

QUESTION 61
Refer to the exhibit.

An engineer received a ticket about a slowed-down web application The engineer runs the #netstat -an command. How must the engineer interpret the results?

QUESTION 62
A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

QUESTION 63
An engineer needs to configure network systems to detect command and control communications by decrypting ingress and egress perimeter traffic and allowing network security devices to detect malicious outbound communications. Which technology should be used to accomplish the task?

QUESTION 64
What are two denial-of-service (DoS) attacks? (Choose two)

QUESTION 65
A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

QUESTION 66
Refer to the exhibit.

What is occurring in this network?

QUESTION 67
What is a difference between tampered and untampered disk images?