Question 1

What is a difference between an inline and a tap mode traffic monitoring?

Accepted Answer

Correct answer: D

Question 2

Which of these describes SOC metrics in relation to security incidents?

Accepted Answer

Correct answer: A

Question 3

What causes events on a Windows system to show Event Code 4625 in the log messages?

Accepted Answer

Correct answer: B

Question 4

When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification.
Which information is available on the server certificate?

Accepted Answer

Correct answer: D

Question 5

What is the difference between the ACK flag and the RST flag in the NetFlow log session?

Accepted Answer

Correct answer: D

Question 6

An engineer must compare NIST vs ISO frameworks The engineer deeded to compare as readable documentation and also to watch a comparison video review.
Using Windows 10 OS. the engineer started a browser and searched for a NIST document and then opened a new tab in the same browser and searched for an
ISO document for comparison
The engineer tried to watch the video, but there 'was an audio problem with OS so the engineer had to troubleshoot it At first the engineer started CMD and looked
fee a driver path then locked for a corresponding registry in the registry editor The engineer enabled "Audiosrv" in task manager and put it on auto start and the
problem was solved Which two components of the OS did the engineer touch? (Choose two)

Accepted Answer

Correct answer: AC

Question 7

An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day, an engineer noticed a disabled
antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this
investigation?

Accepted Answer

Correct answer: B

Question 8

What is a difference between inline traffic interrogation and traffic mirroring?

Accepted Answer

Inline traffic interrogation analyzes traffic in real time and has the ability to prevent certain traffic from being forwarded Traffic mirroring doesn't pass the live traffic
instead it copies traffic from one or more source ports and sends the copied traffic to one or more destinations for analysis by a network analyzer or other
monitoring device

Question 9

What is the difference between deep packet inspection and stateful inspection?

Accepted Answer

Correct answer: D

Question 10

A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if
executed, creates and writes to a new PHP file on the webserver. Which event category is described?

Accepted Answer

Correct answer: D