3. Managing Cyber Security Incident Response

Question 1

A security breach has been reported in your organization. As a cybersecurity analyst, you have been tasked with investigating the security breach.

You decide to use the Diamond Model of Intrusion Analysis as a guide. Which of the following option lists the features of this model?

A)Adversary, Infrastructure, Capability, Victim

B)Reconnaissance, Adversary, Infrastructure, Capability, Victim

C)Adversary, Delivery, Infrastructure, Capability, Victim

D)Infrastructure, Capability, Exploitation, Victim

Answer 1

The diamond represents the relationship between the four core features of an intrusive event or incident.

Adversary – an individual or a group attacking your systems or network.

Infrastructure – any kind of physical or logical resources, such as email address or an IP address, used by the attacker to carry out an attack.

Capability – represents the tools and techniques used by attacker to carry out an attack.
Victim – includes people, services, and network assets the adversary has targeted for the attack.

Delivery, Reconnaissance, and Exploitation are all stages in the Cyber Kill Chain model, not the Diamond Model of Intrusion Analysis.

Question 2

Your organization has developed a business-critical application and conducted an external audit before go-live.

As an auditor, you have identified an issue that focuses on application design and architecture flaws.

Which of the following should you recommend as a mitigation for the highlighted issue? (Choose all that apply.)

A)Maintain up-to-date inventory of the components used by the application.

B)Allow input validation on the server side.

C)Remove unnecessary ports and services and deploy application with minimal configuration.

D)Use built-in ready-to-use libraries and components for new applications and avoid building from scratch.

E)Integrate security from the start in all phases of the software development life cycle (SDLC).

Answer 2

This vulnerability is found in applications where appropriate business and security requirements are not considered during the business case phase. OWASP provides these recommendations to mitigate the vulnerabilities associated with insecure design:

Integrate security from the start in all phases of the software development life cycle (SDLC).

Use built-in ready-to-use libraries and components for new applications and avoid building from scratch.

Make use of threat modelling to design critical functions such as authentication, access control, and business logic.
Identify attack scenarios for application in each tier.

Use plausibility testing to check whether certain inputs are acceptable.

Input validation on the server side is used to mitigate injection flaws in the web application.

Closing unnecessary ports and services and deploying applications with minimal configuration is used to mitigate security misconfigurations.

Maintaining an up-to-date inventory of components along with their versions is used to mitigate the risk posed by vulnerable and outdated components.

Question 3

You have been hired as a cybersecurity analyst to perform a penetration test for your organization. As part of the penetration test activities, you plan to use Wireshark and Nmap.

During which phase of the Cyber Kill Chain process will you use these tools?

A)Reconnaissance
B)Weaponization
C)Exploitation
D)Delivery

Answer 3

Wireshark and Nmap are tools used during the reconnaissance phase of the Cyber Kill Chain process. Wireshark is a highly accurate sniffer tool used for network analysis, and Nmap is a free tool used for network discovery and auditing.

Question 4

Which of the following operations would likely take place during the eradication stage of IR?

A)rollback plan
B)isolation
C)applying compensating controls
D)reimaging

Answer 4

In many cases, a system can be returned to normal functionality faster by simply wiping out the old drive and reimaging the system, which is done during the eradication stage of incident response (IR).

Question 5

A penetration tester was able to convince an employee to give them valid login credentials, including their username and password. You need to prevent this from happening in the future.

Which remediation step is recommended?

A)Increase password complexity requirements.

B)Implement an IPS.

C)Implement multi-factor authentication.

D)Mandate all employees take security awareness training.

Answer 5

Mandating that all employees take security awareness training is recommended. The penetration tester used social engineering to obtain valid login credentials. The only way to prevent this type of attack is to ensure that employees understand how to recognize and respond to social engineering attacks.

Question 6

Today you received an email from a department head who informs you that data located on the Sales server has been altered and is not in the state it was last week. Upon investigation, you find that an attack on the server occurred last week, which the team knew about. Which part of determining the scope of the attack was NOT done?

A)verifying data integrity
B)economic impact assessment
C)estimating recovery time
D)determining downtime

Answer 6

Verifying data integrity is part of determining the scope of an attack. Data integrity refers to the correctness, completeness, and soundness of the data. One of the goals of integrity services is to protect the integrity of data, or at least to provide a means of discovering when data has been corrupted or changed without authorization. Because data does not move from its storage location in a data integrity attack, one security challenge is that the effects of the attack may not be detected for years, until there is a reason to question the data.

Question 7

How to determine a scope of an attack?

Answer 7

Determining the scope of an attack is an important step required to prioritize responses to attacks. Scope includes the following factors:

Downtime – refers to the amount of time access to resources were interrupted
Recovery time – refers to the amount of time taken to recover from the incident
Data integrity – refers to the amount of data corrupted or altered during the incident
Economic – the cost of the incident to the organization
System process criticality – refers to the criticality of the system involved

Question 8

Your organization is developing a business-critical application. As a cybersecurity advisor, you have recommended developers adopt the Open Web Application Security Project (OWASP) Top 10 framework and implement OWASP best practices to enhance web application security vulnerabilities.

Which of the following is not an OWASP Top 10 2021 web application security vulnerability?

A)Security Misconfigurations
B)Input Validation
C)Broken Access Control
D)Injections

Answer 8

Input Validation is not an OWASP Top 10 2021 web application security vulnerability. Input validation is a mitigation to injection vulnerabilities, which is categorized under A03:2021 – Injection.

Question 9

When engaging a third-party incident responder, which of the following is the LEAST important consideration?

A)Their procedures for capturing and preserving vital attack data

B)Their procedures for providing essential logs, packet captures, and volatile memory dumps

C)The identification of security tools in use by the organization that can taint evidence

D)The exchange of contact information

Answer 9

While it is certainly an important process, the exchange of contact information is the least important consideration of those listed. The other three considerations directly affect the selection of and the quality of work done by the vendor.

In some cases, an organization does not have the resources to invest in maintaining a first responder capability, and they need to engage the services of a third-party incident response provider. While this may serve the organization well, there are a few considerations and decisions to be made:

What are their procedures for capturing and preserving vital attack data?

How will the organization engage with its incident response provider in terms of:

Providing essential logs, packet captures, and volatile memory dumps

Running security tools that can taint evidence

Question 10

During which stage of the incident recovery process do you ensure that all security monitoring and logging is occurring correctly?

A)validation
B)containment
C)eradication
D)incident summary report

Answer 10

Verifying that all logging/communication for security monitoring is being done correctly occurs during the validation stage of the incident recovery process. This verification is important to ensure that investigators are able to fully investigate an incident using the logs. Log evidence may be the only indicator that an incident is occurring during a well-hidden but active security breach.

Question 11

The validation stage of the recovery process includes:

Answer 11

The validation stage also includes patching, permissions, and scanning:

Patching – to update or at least check for updates for a variety of components. This includes all patches for the operating system, updates for any applications that may be running, and updates to all antimalware software that is installed. This is the correct action to take when you have reimaged or reinstalled the operating system.

Permissions – to ensure that all permissions are in the state they should be. This would be done when the system is not reinstalled or reimaged.

Scanning – to use a vulnerability scanner on all the devices or network of devices that were affected by the incident. This would be done when not reinstalling or reimaging the device.

Question 12

Which concept involves contracting with a third party to provide a location and equipment to be used in the event of an emergency?

A)Alternate business practices
B)Alternate processing site
C)Disaster recovery plan
D)Offsite storage

Answer 12

Alternate processing sites involve contracting with a third party who provides a location and equipment to be used in the event of an emergency. Alternate processing sites can be referred to as hot, warm, or cold sites, depending on the level of equipment that they provide.

Question 13

You are a cybersecurity analyst for your organization. You are presenting the benefits of implementing the MITRE ATT&CK framework and its use cases to organization leadership.

Which of the following is NOT a use case for the MITRE ATT&CK framework?

A)Strengthening the organization’s cybersecurity intelligence system.

B)Conducting a security gap analysis and planning security improvements.

C)Assessing the security maturity of your organization’s SOC.

D)Finding the most common web application vulnerabilities.

Answer 13

Finding the most common web application vulnerabilities is not a use case for the MITRE ATT&CK framework. To identify common web-application vulnerabilities, you should use the Open Web Application Security Project (OWASP) Top 10 list.

OWASP is a group that monitors cybersecurity attacks, specifically web attacks.

OWASP maintains a list of the top ten attacks which is available on an ongoing basis.
This group also holds regular meetings at chapters throughout the world, providing resources and tools such as testing procedures and code review steps.

Question 14

Common use cases for the MITRE ATT&CK framework include:

Answer 14

Conducting security gap analysis and planning security improvements within the organization.

Assessing the security maturity for your organization’s SOC.
Strengthening the organization’s cybersecurity intelligence system.

Performing user and entity behavior analytics (UEBA).

Acquiring common knowledge useful when collaborating with consultants and vendors.

Creating more realistic scenarios for red team exercises and adversary emulations.

Question 15

After some issues with damaged evidence during a forensic investigation, the team is reviewing the collection and storage of evidence to improve the process. You are reviewing the features of various tamper-evident bags to be used to hold evidence, such as hard drives and other storage devices. Which of the following is the MOST important feature?

A)Includes form on bag cover
B)Made of fireproof material
C)Made of non-translucent material
D)Provides anti-static shielding

Answer 15

The most important factor is that the bag is made of anti-static materials in order to prevent static buildup damaging or corrupting any of the contents of the storage device.

While some bags are marketed as fire resistant, none of them are truly fireproof. Moreover, the heat will probably damage the hard drive anyway.

Most evidence bags do include the form on bag cover, but that is not the most important feature. The most important factor is that it be made of anti-static materials.

It is not important that the bag be made of non-translucent material. The only reason for that would be to prevent seeing what is in the bag and that is relatively unimportant for evidence that is located on a drive and cannot be seen anyway.

Question 16

Penetration testing is planned for your organization’s network. The penetration tester is using Open-Source Security Testing Methodology Manual (OSSTMM) best practices to implement the testing.

Which type of security testing is performed when the pen testers are engaged with knowledge of the target’s processes and operational security, but the target organization is not aware of what, how, and when penetration tester will be testing?

A)Blind testing
B)Tandem testing
C)Reversal testing
D)Partially known environment testing

Answer 16

Reversal testing refers to testing when the pen testers are engaged with full knowledge of its processes and operational security but is NOT aware of what, how, and when penetration testing will occur. The purpose of this type of testing is to audit how prepared the target organization is for unknown attacks. This kind of testing is also called a Red Team exercise.

Blind testing refers to testing when the security analyst performing the testing is not aware of the target’s infrastructure or its controls. However, the target is aware of the testing in advance and knows when and by whom the testing will be carried out. This is an incorrect choice; it is the reverse of the parameters presented for the given scenario.

Partially known environment testing refers to testing when the cybersecurity analyst is provided with limited knowledge about the target’s current infrastructure, controls, and channels. However, the target is aware of the testing in advance and knows when and by whom the testing will be carried out. This type of test is usually done by internal security teams to perform a self-assessment of their systems, networks, or applications. This testing was previously referred to as gray box testing.

Tandem testing is also not the correct choice in the given scenario. In tandem testing, both the security analyst and the target are aware and prepared for the testing. The cybersecurity analyst has full knowledge of the target’s infrastructure, controls, and channels. The objective of tandem testing is to audit the protection and controls of the target. However, it will not test the target for preparedness against unknown attacks. This type of testing is also known as an in-house audit or a crystal box test.

Question 17

Your company’s security policy states that passwords should never be transmitted in plain text. You need to determine if this policy is being followed. Which tool should you use?

A)vulnerability scanner
B)protocol analyzer
C)network mapper
D)password cracker

Answer 17

You would use a protocol analyzer to determine if passwords are being transmitted in plain text. Protocol analyzers capture packets as they are transmitted on the network. If a password is transmitted in plain text, you will be able to see the password in the packet. Protocol analyzers are also called network analyzers or packet sniffers.

Question 18

HTTP interceptor

Answer 18

Another tool that you need to understand is an HTTP interceptor. An HTTP interceptor is a pseudo-proxy server that allows you to view the two-way communication that occurs between a web browser and the Internet. It controls cookies being sent and received. It allows you to view each HTTP header in its entirety and browse anonymously by withholding the Referrer tag.

Question 19

Passive reconnaissance and intelligence-gathering tools

Answer 19

Passive reconnaissance and intelligence-gathering tools can also be used as part of your enterprise’s security assessment. Passive tools only provide information about an attacker, device, or entity, and include the following:

Social media – allows you to obtain details about individuals that are publicly available.
Whois – provides details on the owner of a web site.

Routing tables – provide details on how a packet is routed to a particular entity.

DNS records – a way to determine the host names and possible IP addresses for an organization.

Search engines – allow you to collect any publicly available information about the organization, such as organizational structure, senior management information, and email addresses.

Using passive reconnaissance and intelligence-gathering tools such as these is referred to as open-source intelligence.

Question 20

During a forensic investigation, your assistant was placed in charge of maintaining the documentation for law enforcement. She needs to record the names and contact information of the person who reported the incident. Which form should be used for this purpose?

A)Chain of custody form
B)Incident response plan
C)Call/escalation list
D)Incident form

Answer 20

The incident form will be used to describe the incident in detail. It should include sections to record CMOS and hard drive information, image archive details, analysis platform information, and other details. It should also include the name and contact information of the person who reported the incident.

Question 21

Your organization has recently undergone a hacker attack. You have been tasked with preserving the data evidence. You must follow the appropriate eDiscovery process. You are currently engaged in the Preservation and Collection process. Which of the following guidelines should you follow? (Choose all that apply.)

A)The data acquisition should include both bit-stream imaging and logical backups.
B)The chain of custody should be preserved from the data acquisition phase to the presentation phase.

C)The data acquisition should be from a live system to include volatile data when possible.

D)Hashing of acquired data should occur only when the data is acquired and when the data is modified.

Answer 21

When following the eDiscovery process guidelines, you should keep the following points in mind regarding the Preservation and Collection process:

The data acquisition phase should be from a live system to include volatile data when possible.

The data acquisition should include both bit-stream
imaging and logical backups.

The chain of custody should be preserved from the data acquisition phase to the presentation phase.

While it is true that the hashing of acquired data should occur when the data is acquired and when the data is modified, these are not the only situations that require hashing. Hashing should also be performed when a custody transfer of the data occurs.

Other points to keep in mind during the Preservation and Collection process include the following:

A consistent process and policy should be documented and followed at all times.
Forensic toolkits should be used.

The data should not be altered in any manner, within reason.
Logs, both paper and electronic, must be maintained.
At least two copies of collected data should be maintained.

Question 22

The stages of Forensic Discovery include the following:

Answer 22

Verification – Confirm that an incident has occurred.
System Description – Collect detailed descriptions of the systems in scope.

Evidence Acquisition – Acquire the relevant data in scope, minimizing data loss, in a manner that is legally defensible. This is primarily concerned with the minimization of data loss, the recording of detailed notes, the analysis of collected data, and reporting findings.

Data Analysis – This includes media analysis, string/byte search, timeline analysis, and data recovery.

Results Reporting – Provide evidence to prove or disprove statement of facts.

Question 23

The stages of eDiscovery include the following:

Answer 23

Identification – Verify the triggering event that has occurred. Find and assign potential sources of data, subject matter experts, and other required resources.

Preservation and Collection – Acquire the relevant data in scope, minimizing data loss, in a manner that is legally defensible. This is primarily concerned with the minimization of data loss, the recording of detailed notes, the analysis of collected data, and reporting findings.

Processing, Review, and Analysis – Process and analyze the data while ensuring that data loss is minimized.

Production – Prepare and produce electronically stored information (ESI) in a format that has already been agreed to by the parties.

Presentation – Provide evidence to prove or disprove statement of facts.

Question 24

When preparing an eDiscovery policy for your organization, you need to consider the following facets:

Answer 24

Electronic inventory and asset control – You must ensure that all assets involved in the eDiscovery process are inventoried and controlled. Unauthorized users must not have access to any assets needed in eDiscovery.

Data retention policies – Data must be retained as long as required. Organizations should categorize data and then decide the amount of time that each type of data is to be retained. Data retention policies are the most important policies in the eDiscovery process. They also include systematic review, retention, and destruction of business documents.

Data recovery and storage – Data must be securely stored to ensure maximum protection. In addition, data recovery policies must be established to ensure that data is not altered in any way during the recovery. Data recovery and storage is the process of salvaging data from damaged, failed, corrupted, or inaccessible storage when it cannot be accessed normally.

Data ownership – Data owners are responsible for classifying data. These data classifications are then assigned data retention policies and data recovery and storage policies.

Data handling – A data handling policy should be established to ensure that the chain of custody protects the integrity of the data.

Question 25

Your organization is obligated to comply with PCI DSS and NIST security requirements. As a cybersecurity analyst, you must assess the controls used to satisfy these security requirements. You plan to use the Open-Source Security Testing Methodology Manual (OSSTMM) for your assessment.

Which of the following are the correct security areas or channels identified by OSSTMM?

A)Human Security, Physical and Environmental Security, Wireless Communications, Telecommunications, Data Networks

B)Human Security, Physical Security, Wireless Communications, Telecommunications, Operations Security

C)Organization of Information Security, Human Security, Physical Security, Wireless Communications, Telecommunications, Data Networks

D)Human Security, Physical Security, Wireless Communications, Telecommunications, Data Networks

Answer 25

Human Security, Physical Security, Wireless Communications, Telecommunications, and Data Networks are the correct channels of the OSSTMM framework. The OSSTMM framework is a peer-reviewed auditing process maintained by Institute for Security and Open Methodologies (ISECOM). The framework was primarily created as a security auditing methodology to validate satisfaction with industry and regulatory requirements. You can tailor it as needed per your organization’s requirements. OSSTMM identifies five security areas (called channels):

Human Security – assesses the security awareness levels and effectiveness of security training within the organization.

Physical Security – assesses physical security controls such as access controls, perimeter security, CCTVs, building or facility level controls.

Wireless Communications – assesses the security of all wireless communications used by your organization.

Telecommunications – assesses non-wireless types of communication channels such as VoIP and PBX in your organization’s infrastructure.
Data Networks – assesses computer and network security in your organization’s infrastructure.

Operations Security, Organization of Information Security, and Physical and Environmental Security are all security domains in ISO 27001 standard. They are not part of the OSSTMM.

Question 26

What preserves the existence of relevant electronic and paper records when litigation is imminent?

A)Incident response plan
B)Data sovereignty
C)Chain of custody
D)Legal hold

Answer 26

Legal hold is the term used for the preservation of information relevant to an impending lawsuit. Personnel will be instructed not to destroy or alter information relating to the topic of the lawsuit.

Question 27

Your organization wants to use the Open-Source Security Testing Methodology Manual (OSSTMM) framework for meeting your organization’s compliances requirements.

Which of the following compliances is NOT recognized by the OSSTMM framework?

A)Standards-based
B)Security audit
C)Contractual
D)Legislative

Answer 27

A security audit is not a type of compliance recognized by the OSSTMM framework. A security audit is used to evaluate the effectiveness of implemented security controls within your organization. Audits can be internal or external. Internal audits are conducted by independent audit teams to evaluate the effectiveness of controls. However, external audits are conducted by independent third-party organizations to evaluate the effectiveness of controls against regulatory or standard requirements.

Question 28

The OSSTMM framework recognizes three types of compliance:

Answer 28

Legislative – Legislative compliance is enforced by regional regulatory bodies. It is mandatory to comply with regulatory requirements enforced by the government. Failing to comply with the regulatory requirements can lead to heavy fines and charges. Examples of legislative requirements are Sarbanes-Oxley (SOX), the EU General Data Protection Regulation (GDPR), and the Health Insurance Portability and Accountability Act (HIPAA).

Contractual – Contractual compliance is enforced by groups such as customers and vendors through documented contractual requirements in master service agreements (MSAs). Parties signing the contract must comply with contractual requirements. Failure to comply with contractual requirements may lead to fines, penalties, and loss of reputation. An example of a contractual requirement is the Payment Card Industry Data Security Standard (PCI DSS), enforced by VISA and Mastercard. Merchants who handle credit card data must comply with it.

Standards-based – Compliance with standards is enforced within the organization or by the customer to whom the organization is providing services. Failure to comply with standard requirements may lead to loss of reputation or dismissal of certification from the certifying body. For example, ISO 27001 is the international standard for information security.

Question 29

You are a cybersecurity analyst and you observed an attack on your organization’s website. While investigating, you found the following URL has been executed by the attacker.

https://attack.com/app/accountView?id=’ or ‘1’=’1

Which of the following OWASP Top 10 vulnerabilities has been exploited by the attacker?

A)Injection
B)Vulnerable and Outdated Components
C)Broken Access Control
D)Server-Side Request Forgery

Answer 29

The attacker attempted an injection. An application is vulnerable to an injection attack when user-input data is not validated by the application. Some common injections are SQL, NoSQL, OS Command, Lightweight Directory Access Protocol (LDAP), and Lightweight Directory Access Protocol (XEL).

You should use safe APIs and use positive server-side input validation to mitigate this vulnerability. For example, untrusted data is used by the application in the construction of the following vulnerable SQL call:

String query = “SELECT * FROM sales WHERE custID=’” + request.getParameter(“id”) + “’”;

The attacker will modify the “ID” parameter in the above SQL call in their browser to send UNION SLEEP(10). For example:

http://attack.com/app/accountView?id=’ UNION SELECT SLEEP(10)

This will modify the intent of the original query and will return all records from the sales table.

Applications are vulnerable when you use unsupported versions of software or components embedded in the application. You should always use supported and updated software and application components in your production environment.

A server-side request forgery vulnerability exists in applications when a remote source is retrieved by the web application without validating the user-supplied URL. You can implement appropriate controls at the Network layer and Application layer to prevent SSRF vulnerabilities.

Failure to enforce an access control policy can lead to users acting outside of intended permissions, which leads to a broken access control vulnerability.

Question 30

You are a cybersecurity analyst for your organization. You are presenting cybersecurity models to your leadership for consideration to be adopted within the organization.

Which of the following is a benefit of using the MITRE ATT&CK model within your organization?

A)Helps maintain compliance with regulatory security requirements.

B)Helps gain understanding of the tactics and techniques used by an attacker.

C)Helps to classify and detect the stage of the security incident.

D)Helps identify an attacker’s motivation, victim, and technology used in an attack.

Answer 30

The MITRE ATT&CK model gives insight into the tactics and techniques used by an attacker. The MITRE ATT&CK model provides a framework for understanding the tactics and techniques used by adversaries in cybersecurity attacks. The MITRE ATT&CK model is a global knowledge base available to everyone. Organizations can use this model to build more specific threat models and as a tool to strengthen their security posture.

Question 31

The Dimond Model of Intrusion Analysis is used for?

Answer 31

The Diamond Model of Intrusion Analysis is more appropriate for identifying an attacker’s motivation, victim, and technology used in an attack. The Diamond Model of Intrusion Analysis maps an adversary’s activities and represents them in the form of a diamond. The diamond represents the relationship between the four core features of an intrusive event or incident: adversary, infrastructure, capabilities, and victim.

Question 32

The OSSTMM is used for?

Answer 32

The Open-Source Security Testing Methodology Manual (OSSTMM) is primarily used as a security auditing methodology and can validate compliance with regulatory and industry standard requirements.

Question 33

The kill chain model is used for?

Answer 33

The Cyber Kill Chain model is more appropriate for detecting in which stage of attack the security incident is in. Cybersecurity professionals use the model for penetration testing and understand how attacker can frame the attack. It also helps security professionals prevent the attacks up to certain point and improve their ability to respond and analyze incidents.

Question 34

The business continuity team is interviewing users to gather information about business units and their functions. Which part of the business continuity plan includes this analysis?

A)contingency plan
B)disaster recovery plan
C)occupant emergency plan
D)business impact analysis

Answer 34

The business impact analysis (BIA) includes interviews to gather information about business units and their functions.

Question 35

You are attacking a critical server as part of a penetration testing effort .You gained access to an inactive local privileged account and used it to shut down the server.

In which stage of the Cyber Kill Chain process are you operating?

A)Command and Control
B)Installation
C)Actions on Objectives
D)Exploitation

Answer 35

Shutting down the critical server occurred during the Actions on Objectives stage of the Cyber Kill Chain process. This is the final phase of the process, during which the attacker carries out their intended actions on the target systems. If the attacker reaches this seventh and final phase of the Cyber Kill Chain process, the negative impact will be greater and more difficult to remediate.

Question 36

Which of the following elements is created to ensure that your company is able to resume operations after an unplanned downtime in a timely manner?

A)incident response plan
B)business impact analysis
C)vulnerability analysis
D)disaster recovery plan

Answer 36

A disaster recovery plan (DRP) is created to ensure that your company is able to resume operations after a disaster in a timely manner. As part of the Business Continuity Plan (BCP), the DRP mainly focuses on alternative procedures for processing transactions in the short term. It is carried out when the emergency occurs and immediately after. The DRP should include a hierarchical list of critical systems. Therefore, the first step in the development of a DRP is the identification of critical syste

Question 37

A cybersecurity analyst in your organization is investigating a security incident. She is focusing on specific attacker behaviors and attempting to identify the attacker’s motivation, the victims, and the technology used to wage the attack.

Which of the following cybersecurity models is your cybersecurity analyst using?

A)The Lockheed Martin Cyber Kill Chain
B)The OWASP Model
C)The MITRE ATT&CK Model
D)The Diamond Model of Intrusion Analysis

Question 38

During a meeting, you present management with a list of the access controls used on your network. You explain that these controls include preventative, detective, and corrective controls. Which of the following is an example of a corrective control?

A)antivirus software
B)audit log
C)intrusion detection system (IDS)
D)router

Answer 38

The cybersecurity analyst is using the Diamond Model of Intrusion Analysis. This analysis model is used to map an adversary’s activities in the form of diamond. The diamond represents the relationship between the four core features of an intrusive event or incident.

Adversary – an individual or a group attacking your systems or network.

Infrastructure – any kind of physical or logical resources, such as email address or an IP address, used by the attacker to carry out an attack.

Capability – represents the tools and techniques used by attacker to carry out an attack.

Victim – includes people, services, and network assets the adversary has targeted for the attack.

The Cyber Kill Chain model is a cybersecurity framework used to model the typical steps taken in a cyber attack. Cybersecurity professionals use the model for penetration testing and to understand how attackers frame their attacks. It also helps security professionals prevent attacks and improves their ability to respond to and analyze incidents.

The MITRE ATT&CK model gives insight into the tactics and techniques used by an attacker. The MITRE ATT&CK model provides a framework for understanding the tactics and techniques used by adversaries in cybersecurity attacks. The MITRE ATT&CK model is a global knowledge base available to everyone. Organizations can use this model to build more specific threat models and as a tool to strengthen their security posture.

The Open Web Application Security Project (OWASP) is a group that monitors attacks, specifically web attacks. OWASP maintains a list of the top ten attacks on an ongoing basis. This group also holds regular meetings at chapters throughout the world, providing resources and tools including testing procedures, code review steps, and development guidelines.

Question 39

During a meeting, you present management with a list of the access controls used on your network. You explain that these controls include preventative, detective, and corrective controls. Which of the following is an example of a corrective control?

A)antivirus software
B)audit log
C)intrusion detection system (IDS)
D)router

Answer 39

Antivirus software is an example of a corrective technical control because it attempts to correct any damage that was inflicted during a security breach. Antivirus software can also be considered a compensative technical control.

Routers are an example of preventative technical controls because they prevent security breaches. Routers are also a compensative technical control.

IDSes are a detective technical control and a compensative technical control.

Audit logs are an example of detective technical controls because they can be used to detect security breaches. Audit logs are also a compensative technical control.

Question 40

In which stage of the incident recovery process does the cybersecurity analyst perform scanning?

A)Containment
B)Validation
C)Eradication
D)Corrective actions

Answer 40

Scanning is performed during the validation stage. At this time, the device is checked to ensure that techniques applied during the eradication stage were successful at removing the threat. The activities conducted during this stage are patching, scanning, verifying logging, and permissions review

Question 41

During which stage of IR are you trying to limit the scope of the incident?

A)discovery
B)validation
C)containment
D)eradication

Answer 41

The scope of an incident describes the networks and systems at risk. During the containment stage of incident response (IR), the goal is to minimize the number of systems involved by stopping the spread.

Question 42

You are a cybersecurity analyst and have been asked to prepare training content for developers which will focus on the OWASP Top 10 2021 vulnerabilities list.

Which of the following is the eighth OWASP vulnerability in the Top 10 list of vulnerabilities?

A)Vulnerable and Outdated Components

B)Security Logging and Monitoring Failures

C)Software and Data Integrity Failures

D)Identification and Authentication Failures

Answer 42

The eighth vulnerability in the OWASP Top 10 list is Software and Data Integrity Failures.

Question 43

You are a cybersecurity advisor for your organization. You have been asked to research a the recently detected attack within your organization.

You want to understand more about the attacker’s tactics and techniques. Which of the following will BEST achieve your objective?

A)The Cyber Kill Chain model
B)The Diamond Model of Intrusion Analysis.
C)Vulnerability assessment
D)The MITRE ATT&CK framework

Answer 43

The MITRE ATT&CK model is a global knowledge base that gives insight into the tactics and techniques used by an attacker. Organizations can use this model to build more specific threat models and as a tool to strengthen their security posture.

Question 44

Your organization develops in-house applications. You have recently integrated the OWASP testing framework in your software development life cycle (DSLC) process.

During which phase of the OWASP Testing framework should you review the security requirements?

A)During deployment
B)During development
C)During definition and design
D)Before development begins

Answer 44

You should review the security requirements during the Definition and Design phase of the OWASP Testing framework.

Question 45

A log analysis reveals the following input into a login portal:

Jsmith2)(&)
Admin1

Which type of attack has most likely occurred?

A)LDAP Injection
B)XSS
C)Brute Force
D)SQL Injection

Answer 45

This is most likely a Lightweight Directory Access Protocol (LDAP) injection attack. Because LDAP is a protocol that is often used for authentication, the above is an example of an LDAP injection to bypass authentication.

LDAP injection is an attack that sends malicious LDAP queries to a web application that could result in sensitive data disclosure or authentication bypass. The & symbol will end the query after the first line. So, the attacker is trying to create a condition that effectively asks the backend database to check for a valid user named Jsmith2 and, if one is found, to allow for authentication. The attacker does not need to enter a proper matching password because the query is ended prematurely.

Question 46

As part of the incident response team, you have been called in to help with an attack on your company’s web server. You are currently working to identify the root cause of the attack. During which step of incident response does root cause analysis occur?

A)Recovery
B)Containment
C)Preparation
D)Identification
E)Eradication
F)Lessons Learned

Answer 46

You would perform root cause analysis during the lessons learned step, sometimes referred to as the review and close step. This is the final step in incident response.

Question 47

While performing a penetration test, you encounter several issues that you plan to document in the final report. However, you need to ensure that management is immediately notified of any IOCs documented in the communication escalation path.

Which of the following is MOST likely to result in the need for immediate communication to management?

A)A finding was discovered regarding an out-of-scope system.

B)A network compromise has previously occurred about which management knows nothing.

C)Encrypted personally identifiable information (PII) was discovered on several systems.

D)Unpatched applications exist on a system marked for retirement.

Answer 47

Of the situations given, only the network compromise that has previously occurred about which management knows nothing should be immediately reported to management.

Question 48

You are a cybersecurity analyst for your organization. During an incident investigation, you observe that a distributed denial of service (DDoS) attack was used on a critical production server.

During which phase of the Cyber Kill Chain process is a DDoS attack used?

A)Exploitation
B)Weaponization
C)Installation
D)Delivery

Answer 48

A DDoS attack is used during the Weaponization phase, which is the second phase of the Cyber Kill Chain process. Attackers use weapons to carry out attacks on the target system or network. Some of the cyber weapons used by attackers are denial of service attacks, botnets, and malware. As the name suggests, this phase is used to develop weapons against the target network. The attacker or pen tester selects an attack vector such as ransomware, viruses, or social engineering to exploit the known vulnerability.

Question 49

During which stage of the incident recovery process are areas that need improvement identified?

A)Corrective actions
B)Eradication
C)Incident summary report
D)Validation

Answer 49

The incident summary report is where areas that need improvement are identified. Other details from this report should include:

When was the problem first detected and by whom?
What was the scope of the incident?
How was it contained and eradicated?
What work was performed during recovery?
In which areas were the CIRT teams effective?
In which areas did the CIRT teams need improvement?
The recovery process has five major parts, which are:

Containment
Eradication
Validation
Corrective actions (remediation and re-imaging)
Incident summary reporting

Question 50

Which of the following options simulates a disaster and allows you to check the thoroughness of your disaster recovery plan?

A)Tabletop exercises
B)Business continuity plans
C)After-action reports
D)Critical business functions

Answer 50

A tabletop exercise simulates a disaster and allows you to check the thoroughness of your disaster recovery plan. You should perform a document review during all exercises. Apart from a tabletop exercise, you can also perform a walkthrough, a simulation, parallel testing, and cutover testing to test your disaster recovery plans. If your plan has a weakness, it is better to discover it during an exercise than during a live event.

Question 51

You have recently installed an enterprise-level SOAR solution for incident response. The response team is determining the processes that need to be manually followed when an incident occurs. Which of the following documentation is the team developing?

A)Blue book
B)Orange book
C)Playbook
D)Runbook

Answer 51

A security orchestration, automation, and response (SOAR) playbook is a checklist of incident response steps to be performed when an incident occurs. In Microsoft Azure, the Azure Sentinel service has playbooks that automate and orchestrate responses to threats. You can configure a playbook to run manually or automatically in response to specific alerts or incidents that are triggered by an automation rule.

A runbook is a document that contains relevant background information and practical procedures to accomplish IT or DevOps tasks, or address and resolve incidents. It is somewhat like a playbook but is not invoked by an automated process.

The Orange book is the name given to a book by the NIST, part of what is called the Rainbow series, that rates the security of various versions of software and hardware.

The Blue book is another book in the NIST Rainbow series that focuses on the evaluation program itself.

Question 52

You have been hired as the security analyst for your company. You obtain a vulnerability scanner to help you perform your job duties. What does this tool do?

A)detects when network intrusions occur and notifies appropriate personnel

B)identifies security issues on a network and gives suggestions on how to prevent them

C)identifies ports and services that are at risk on a network
D)protects a system against viruses

Answer 52

A vulnerability scanner is an application that identifies security issues on a network and gives suggestions on how to prevent them. Often, a vulnerability scanner goes beyond what a port scanner can do because a vulnerability scanner performs a vulnerability analysis or assessment.

Question 53

Communication details are contained in the penetration test’s engagement plan. One of the members of the penetration testing team wants to ensure that they understand the appropriate communication triggers.

Which of the following is NOT a communication trigger?

A)Completion of a testing stage
B)Unexploited findings
C)Critical findings
D)Indicators of compromise

Answer 53

Unexploited findings is NOT a communication trigger. This information would be contained in the final report.

Communication triggers include: stages of the penetration test, critical findings, and indicators of compromise. These are standard communication triggers. Some organizations may include other communication triggers as part of the engagement plan. It is important that the penetration tester understands these triggers and acts accordingly.