Refer to the exhibit.

An attacker scanned the server using Nmap. What did the attacker obtain from this scan?

1. A. Identified a firewall device preventing the pert state from being returned.
2. B. Identified open SMB ports on the server
3. C. Gathered information on processes running on the server
4. D. Gathered a list of Active Directory users

Correct Answer: C

Which two elements are used for profiling a network? (Choose two.)

1. A. session duration
2. B. total throughput
3. C. running processes
4. D. listening ports
5. E. OS fingerprint

Correct Answer: AB
A network profile should include some important elements, such as the following:
Total throughput – the amount of data passing from a given source to a given destination in a given period of time
Session duration – the time between the establishment of a data flow and its termination Ports used – a list of TCP or UDP processes that are available to accept data
Critical asset address space – the IP addresses or the logical location of essential systems or data
Profiling data are data that system has gathered, these data helps for incident response and to detect incident Network profiling = throughput, sessions duration, port used, Critical Asset Address Space Host profiling = Listening ports, logged in accounts, running processes, running tasks,applications

According to the September 2020 threat intelligence feeds a new malware called Egregor was introduced and used in many attacks. Distnbution of Egregor is pnmanly through a Cobalt Strike that has been installed on victim's workstations using RDP exploits Malware exfiltrates the victim's data to a command and control server. The data is used to force victims pay or lose it by publicly releasing it. Which type of attack is described?

1. A. malware attack
2. B. ransomware attack
3. C. whale-phishing
4. D. insider threat

Correct Answer: B

A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs. Which technology should be used to accomplish this task?

1. A. application whitelisting/blacklisting
2. B. network NGFW
3. C. host-based IDS
4. D. antivirus/antispyware software

Correct Answer: A

What is a difference between tampered and untampered disk images?

1. A. Tampered images have the same stored and computed hash.
2. B. Tampered images are used as evidence.
3. C. Untampered images are used for forensic investigations.
4. D. Untampered images are deliberately altered to preserve as evidence

Correct Answer: D