NEW QUESTION 16
John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is coming.
Which of the following data source will he use to prepare the dashboard?

NEW QUESTION 17
Which of the following security technology is used to attract and trap people who attempt unauthorized or illicit utilization of the host system?

NEW QUESTION 18
Which of the following service provides phishing protection and content filtering to manage the Internet experience on and off your network with the acceptable use or compliance policies?

NEW QUESTION 19
What is the correct sequence of SOC Workflow?

NEW QUESTION 20
Which of the following attack can be eradicated by filtering improper XML syntax?

NEW QUESTION 21
Which of the following contains the performance measures, and proper project and time management details?

NEW QUESTION 22
According to the forensics investigation process, what is the next step carried out right after collecting the evidence?

NEW QUESTION 23
Which of the following can help you eliminate the burden of investigating false positives?

NEW QUESTION 24
InfoSystem LLC, a US-based company, is establishing an in-house SOC. John has been given the responsibility to finalize strategy, policies, and procedures for the SOC.
Identify the job role of John.

NEW QUESTION 25
Daniel is a member of an IRT, which was started recently in a company named Mesh Tech. He wanted to find the purpose and scope of the planned incident response capabilities.
What is he looking for?

NEW QUESTION 26
David is a SOC analyst in Karen Tech. One day an attack is initiated by the intruders but David was not able to find any suspicious events.
This type of incident is categorized into?

NEW QUESTION 27
In which log collection mechanism, the system or application sends log records either on the local disk or over the network.

NEW QUESTION 28
According to the Risk Matrix table, what will be the risk level when the probability of an attack is very low and the impact of that attack is major?

NEW QUESTION 29
An organization is implementing and deploying the SIEM with following capabilities.

What kind of SIEM deployment architecture the organization is planning to implement?

NEW QUESTION 30
Sam, a security analyst with INFOSOL INC., while monitoring and analyzing IIS logs, detected an event matching regex /w*((%27)|(‘))((%6F)|o|(%4F))((%72)|r|(%52))/ix.
What does this event log indicate?

NEW QUESTION 31
Properly applied cyber threat intelligence to the SOC team help them in discovering TTPs.
What does these TTPs refer to?

NEW QUESTION 32
Which of the log storage method arranges event logs in the form of a circular buffer?

NEW QUESTION 33
Which of the following Windows event is logged every time when a user tries to access the “Registry” key?

NEW QUESTION 34
What does Windows event ID 4740 indicate?

NEW QUESTION 35
Which of the following command is used to enable logging in iptables?

NEW QUESTION 36
What is the correct sequence of SOC Workflow?

NEW QUESTION 37
Which of the following tool is used to recover from web application incident?

NEW QUESTION 38
Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.

What does this event log indicate?

NEW QUESTION 39
Daniel is a member of an IRT, which was started recently in a company named Mesh Tech. He wanted to find the purpose and scope of the planned incident response capabilities.
What is he looking for?