QUESTION 82
Electronic evidence may reside in the following:

QUESTION 83
Deleting malicious code and disabling breached user accounts are examples of which of the following?

QUESTION 84
Eric is an incident responder working on developing incident-handling plans and procedures. As part of this process, he is analyzing the organizational network to generate a report and develop policies based on the acquired results.
Which of the following tools will help him in analyzing his network and the related traffic?

QUESTION 85
Incidents such as DDoS that should be handled immediately may be considered as:

QUESTION 86
The region where the CSIRT is bound to serve and what does it and give service to is known as:

QUESTION 87
In NIST risk assessment/ methodology; the process of identifying the boundaries of an IT system along with the resources and information that constitute the system is known as:

QUESTION 88
Which of the following is a common tool used to help detect malicious internal or compromised actors?

QUESTION 89
Which of the following is not called volatile data?

QUESTION 90
Alexis is working as an incident responder in XYZ organization. She was asked to identify and attribute the actors behind an attack that took place recently. In order to do so, she is performing threat attribution that deals with the identification of the specific person, society, or country sponsoring a well-planned and executed intrusion or attack on its target.
Which of the following types of threat attributions has Alexis performed?

QUESTION 91
The message that is received and requires an urgent action and it prompts the recipient to delete certain files or forward it to others is called:

QUESTION 92
Business continuity is defined as the ability of an organization to continue to function even after a disastrous event, accomplished through the deployment of redundant hardware and software, the use of fault tolerant systems, as well as a solid backup and recovery strategy. Identify the plan which is mandatory part of a business continuity plan?

QUESTION 93
The USB tool (depicted below) that is connected to male USB Keyboard cable and not detected by anti-spyware tools is most likely called:

QUESTION 94
Computer viruses are malicious software programs that infect computers and corrupt or delete the data on them. Identify the virus type that specifically infects Microsoft Word files?

QUESTION 95
Any information of probative value that is either stored or transmitted in a digital form during a computer crime is called:

QUESTION 96
What is the name of the type of malicious software or malware designed to deny access to a computer system or data until money is paid?

QUESTION 97
The insider risk matrix consists of technical literacy and business process knowledge vectors. Considering the matrix, one can conclude that:

QUESTION 98
Oscar receives an email from an unknown source containing his domain name oscar.com. Upon checking the link, he found that it contains a malicious URL that redirects to the website evil site.org.
What type of vulnerability is this?

QUESTION 99
Smith employs various malware detection techniques to thoroughly examine the network and its systems for suspicious and malicious malware files.
Among all techniques, which one involves analyzing the memory dumps or binary codes for the traces of malware?

QUESTION 100
US-CERT and Federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization. What is the timeframe required to report an incident under the CAT 4 Federal Agency category?

QUESTION 101
Which of the following techniques helps incident handlers detect man-in-the-middle attacks by finding the new APs and trying to connect an already established channel, even if the spoofed AP consists of similar IP and MAC addresses as the original AP?

QUESTION 102
Which of the following has been used to evade IDS and IPS?

QUESTION 103
Clark, a professional hacker, successfully exploited the web application of a target organization by tampering the form and parameter values. In result, Clark gained access to the information assets of the organization. Identify the vulnerability in the web application exploited by the attacker.

QUESTION 104
Raven is a part of an IH&R team and was info med by her manager to handle and lead the removal of the root cause for an incident and to close all attack vectors to prevent similar incidents in the future. Raven notifies the service providers and developers of affected resources.
Which of the following steps of the incident handling and response process does Raven need to implement to remove the root cause of the incident?

QUESTION 105
Adam is an incident handler who intends to use DBCCLOG command to analyze a database and retrieve the active transaction logfiles for the specified database. The syntax of DBCC LG command is DBCC LOG (<database name>, <output>), where the output parameter specifies the level of information an incident handler wants to retrieve.
If Adam wants to retrieve the full information on each operation along with the hex dump of a current transaction row, which of the following output parameters should Adam use?