IT Certification Exam Questions & Answers

QUESTION 38
An organization is implementing and deploying the SIEM with following capabilities.

What kind of SIEM deployment architecture the organization is planning to implement?

QUESTION 39
Which of the following service provides phishing protection and content filtering to manage the Internet experience on and off your network with the acceptable use or compliance policies?

QUESTION 40
Which of the following data source can be used to detect the traffic associated with Bad Bot User-Agents?

QUESTION 41
Ray is a SOC analyst in a company named Queens Tech. One Day, Queens Tech is affected by a DoS/DDoS attack. For the containment of this incident, Ray and his team are trying to provide additional bandwidth to the network devices and increasing the capacity of the servers.
What is Ray and his team doing?

QUESTION 42
Jason, a SOC Analyst with Maximus Tech, was investigating Cisco ASA Firewall logs and came across the following log entry:
May 06 2018 21:27:27 asa 1: %ASA -5 – 11008: User ‘enable_15’ executed the ‘configure term’ command What does the security level in the above log indicates?

QUESTION 43
Which of the following formula represents the risk?

QUESTION 44
InfoSystem LLC, a US-based company, is establishing an in-house SOC. John has been given the responsibility to finalize strategy, policies, and procedures for the SOC.
Identify the job role of John.

QUESTION 45
Identify the attack in which the attacker exploits a target system through publicly known but still unpatched vulnerabilities.

QUESTION 46
Which of the following is a correct flow of the stages in an incident handling and response (IH&R) process?

QUESTION 47
Harley is working as a SOC analyst with Powell Tech. Powell Inc. is using Internet Information Service (IIS) version 7.0 to host their website.
Where will Harley find the web server logs, if he wants to investigate them for any anomalies?

QUESTION 48
Which of the following formula represents the risk?

QUESTION 49
Which of the following attack can be eradicated by disabling of “allow_url_fopen and allow_url_include” in the php.ini file?

QUESTION 50
Which of the following tool can be used to filter web requests associated with the SQL Injection attack?

QUESTION 51
Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an incident to her for further investigation and confirmation. Charline, after a thorough investigation, confirmed the incident and assigned it with an initial priority.
What would be her next action according to the SOC workflow?

QUESTION 52
In which log collection mechanism, the system or application sends log records either on the local disk or over the network.

QUESTION 53
Bonney’s system has been compromised by a gruesome malware.
What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

QUESTION 54
John, SOC analyst wants to monitor the attempt of process creation activities from any of their Windows endpoints.
Which of following Splunk query will help him to fetch related logs associated with process creation?

QUESTION 55
The Syslog message severity levels are labelled from level 0 to level 7.
What does level 0 indicate?

QUESTION 56
Which of the following are the responsibilities of SIEM Agents?
1.Collecting data received from various devices sending data to SIEM before forwarding it to the central engine.
2.Normalizing data received from various devices sending data to SIEM before forwarding it to the central engine.
3.Co-relating data received from various devices sending data to SIEM before forwarding it to the central engine.
4.Visualizing data received from various devices sending data to SIEM before forwarding it to the central engine.

QUESTION 57
Which of the following tool is used to recover from web application incident?

QUESTION 58
What is the correct sequence of SOC Workflow?

QUESTION 59
Which of the following can help you eliminate the burden of investigating false positives?

QUESTION 60
Wesley is an incident handler in a company named Maddison Tech. One day, he was learning techniques for eradicating the insecure deserialization attacks.
What among the following should Wesley avoid from considering?