Casp test

Question 1

A natural disaster may disrupt operations at Site A, which would then cause an evacuation. Users are unable to log into the domain from their workstations after relocating to Site B.

Answer 1

Drag answer to Directory serveron site A

Question 2

A natural disaster may disrupt operations at Site A, which would then cause the pump room at Site B to become inoperable.

Answer 2

Drag answer to SCADA
Master Controller

Question 3

A natural disaster may disrupt operations at Site A, which would then cause unreliable Internet connectivity at Site B due to route flapping.

Answer 3

Modify BGP Config

Question 4

Code snippet 1 or SQL query that includes ?

Answer 4

SQL injection - perform sanitization

Question 5

if code has “get”

Answer 5

switch to “post”

Question 6

AAA Server IP:

Answer 6

10.1.0.10
default eap TLS
F5o4l3l2y1!

Question 7

VPN Concentrator

Answer 7

AES 256gcm128
F504l3l2y1!
10.1.2.1

Question 8

WAPA

Answer 8

WAP*:A- Disable unneeded services

Question 9

Laptop A

Answer 9

Laptop A- Disable unneeded services

Question 10

Laptop B

Answer 10

Laptop B,. Enabled Disk encryption & Disable unneeded services

Question 11

Switch A

Answer 11

Switch A- Change default administrative password & Disable mmeeded services

Question 12

Switch B

Answer 12

Switch B- Disable unneeded services

Question 13

PC-A
PC-B

Answer 13

PC-A - Disable·unneeded services
PC-B * Disable unneeded services

Question 14

PC-C

Answer 14

• Patch management, Disable unneeded services

Question 15

this will show you ip, port, pid, name of task.

Answer 15

$sudo netstat -nltp
this will show you ip, port, pid, name of task.

Question 16

to see status

Answer 16

$sudo systemctl status -full name service-
to compare

Question 17

to kill process

Answer 17

$sudo kill -9 -pid- Kills the PID

Question 18

to stop process

Answer 18

$sudo systemctl stop
-full name service- Stops service

Question 19

to disable process 5th command

Answer 19

$sudo systemctl disable -full name service-
Disables at startup

Question 20

command to perform after process is diabled at startup to see network connections

Answer 20

$sudo netstat -nltp

Question 21

command to double check the status

Answer 21

$sudo systemctl
status -full name service- double checking

Question 22

10.1.45.65

Answer 22

SFTP Server Disable 8080

Question 23

10.1.45.66

Answer 23

Email Server Disable 415 and 443

Question 24

10.1.45.67

Answer 24

Web Server Disable 21, 80

Question 25

10.1.45.68

Answer 25

UTM Appliance Disable 21

Question 26

During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.

Answer 26

IOC 1 - Update - nothing
IOC 2 - Footprinting - Block ping across
IOC 3 - P2p - block known bad ports