Operation and Incident Response Flashcards
Consider the following snippet from a log file collected on the host with the IP address of 10.10.3.6.
A. Denial of Service attack targeting 10.10.3.6.
B. Port Scanning targeting 10.10.3.2
C. Port Scanning targeting 10.10.3.6.
D. Fragmentation Attack targeting 10.10.3.6.
C. Port Scanning targeting 10.10.3.6.
OBJ-4.1: Port Scanning is the name for the technique used to identify open ports and services available on a network host. Based on the logs, you can see a sequential scan of some commonly used ports (20, 21, 22, 23, 25, 80, 135, 443, 445) with a two-second pause between each attempt. The scan source is 10.10.3.2, and the destination of the scan is 10.10.3.6, making “Port scan targeting 10.10.3.6” the correct choice. IP fragmentation attacks are a common form of denial of service attack, in which the perpetrator overbears a network by exploiting datagram fragmentation mechanisms. A denial-of-service (DoS) attack occurs when legitimate users cannot access information systems, devices, or other network resources due to a malicious cyber threat actor’s actions.
Dion Training has just suffered a website defacement of its public-facing webserver. The CEO believes the company’s biggest competitor may have done this act of vandalism. The decision has been made to contact law enforcement so that evidence can be collected properly for use in a potential court case. Laura is a digital forensics investigator assigned to collect the evidence. She creates a bit-by-bit disk image of the web server’s hard drive as part of her evidence collection. What technology should Laura use after creating the disk image to verify the copy’s data integrity matches that of the original web server’s hard disk?
A. RSA
B. SHA-256
C. AES
D. 3DES
B. SHA-256
(Sample Simulation – On the real exam for this type of question, you would have access to the log files to determine which server on a network might have been affected, and then choose the appropriate actions.) A cybersecurity analyst has determined that an attack has occurred against your company’s network. Fortunately, your company uses a good logging system with a centralized Syslog server, so all the logs are available, collected, and stored properly. According to the cybersecurity analyst, the logs indicate that the database server was the only company server on the network that appears to have been attacked. The network is a critical production network for your organization. Therefore, you have been asked to choose the LEAST disruptive actions on the network while performing the appropriate incident response actions. Which actions do you recommend as part of the response efforts?
A. Isolate infected server
B. Conduct a system server
C. Capture Network Traffic
D. Immediately remove service
C. Capture Network Traffic
A cybersecurity analyst has deployed a custom DLP signature to alert on any files that contain numbers in the format of a social security number (xxx-xx-xxxx). Which of the following concepts within DLP is being utilized?
A. Document Matching
B. Exact Data Matching
C. Statistical Matching
D. Classification
B. Exact Data Matching
You are notified by an external organization that an IP address associated with your company’s email server has been sending spam emails requesting funds as part of a lottery collection scam. An investigation into the incident reveals the email account used was Connor from the sales department and that Connor’s email account was only used from one workstation. You analyze Connor’s workstation and discover several unknown processes running, but netflow analysis reveals no attempted lateral movement to other workstations on the network. Which containment strategy would be most effective to use in this scenario?
A. Isolate the network
B. Unplug the workstation
C. Request disciplinary action
D. Isolate workstation computer
D. Isolate workstation computer
A user reports that every time they try to access https://www.diontraining.com, they receive an error stating “Invalid or Expired Security Certificate.” The technician attempts to connect to the same site from other computers on the network, and no errors or issues are observed. Which of the following settings needs to be changed on the user’s workstation to fix the “Invalid or Expired Security Certificate” error?
A. User Access Control
B. Date and Time
C. UEFI Boot Mode
D. Logos Time
B. Date and Time
Which analysis framework provides a graphical depiction of the attacker’s approach relative to a kill chain?
A. Lockhard Martin Kill Chain
B. MITRE Attack Framework
C. OpenIOc
D. Diamond Model of Intrusion Model
D. Diamond Model of Intrusion Model
An attacker is searching in Google for Cisco VPN configuration files by using the filetype:pcf modifier. The attacker located several of these configuration files and now wants to decode any connectivity passwords that they might contain. What tool should the attacker use?
A. Nmap
B. Nessus
C. Netcat
D. Cain and Abel
D. Cain and Abel
After reviewing the packet above, you discovered there is an unauthorized service running on the host. Which of the following ACL entries should be implemented to prevent further access to the unauthorized service while maintaining full access to the approved services running on this host?
A. Deny IP Host 86.18.10.3 EQ3389
B. Deny TCP any HOST 71.168.10.45 EQ3389
C. Deny TCP any HOST 86.18.10.3 EQ 25
D. Deny IP Host 71.168.10.45 EQ 25
B. Deny TCP any HOST 71.168.10.45 EQ3389
OBJ-4.4: Since the question asks you to prevent unauthorized service access, we need to block port 3389 from accepting connections on 71.168.10.45 (the host). This option will deny ANY workstation from connecting to this machine (host) over the Remote Desktop Protocol service that is unauthorized (port 3389).
Dion Consulting Group has recently been awarded a contract to provide cybersecurity services for a major hospital chain in 48 cities across the United States. You are conducting a vulnerability scan of the hospital’s enterprise network when you detect several devices that could be vulnerable to a buffer overflow attack. Upon further investigation, you determine that these devices are PLCs used to control the hospital’s elevators. Unfortunately, there is not an update available from the elevator manufacturer for these devices. Which of the following mitigations do you recommend?
A. Recommended Isolation
B. Conduct Penetration Test
C. Recommend Immediate Replacement
D. Recommend Immediate Disconnection
A. Recommended Isolation
Dion Training wants to ensure that none of its computers can run a peer-to-peer file-sharing program on its office computers. Which of the following practices should be implemented to achieve this?
A. Enable NAC
B. Application Blocklisting
C. Application Allow Listing
D. Mac Filtering
B. Application Blocklisting
You work as the incident response team lead at Fail to Pass Systems. Sierra, a system administrator, believes an incident has occurred on the network and contacts the SOC. At 2:30 am, you are woken up by a phone call from the CEO of Fail to Pass stating an incident has occurred and that you need to solve this immediately. As you are getting dressed to drive into the office, your phone rings again. This time, the CIO starts asking you a lot of technical questions about the incident. The first you heard of this incident was 5 minutes ago from the CEO, so you don’t have the answers to the CIO’s questions, yet. Based on this scenario, which of the following issues needs to be documented in your lessons learned report once this incident is resolved?
A. A robust method of incident detection
B. A call list/escalation list
C. An establish incident response
D. An offline incident response jump bag or kit
B. A call list/escalation list
You have discovered that an employee has been conducting illegal activities using his workplace computer. You have taken possession of the employee’s laptop according to your company’s procedures and are waiting to give it to law enforcement authorities. What should you do when turning over the laptop to the police?
A. Qurentain the System
B. Document the changes
C. Maintain the chain of custody
D. Preserve the evidence
C. Maintain the chain of custody
You are troubleshooting an issue with a Windows desktop and need to display the machine’s active TCP connections. Which of the following commands should you use?
A. Netstat
B. Ping
C. Ipconfig
D. Net use
A. Netstat
Which of the following items represents a document that includes detailed information on when an incident was detected, how impactful the incident was, how it was remediated, the effectiveness of the incident response, and any identified gaps that might require improvement?
A. Forensic Analysis Report
B. Lessons Learned Report
C. Chain of Custody report
D. Trend Analysis Report
B. Lessons Learned Report
If you cannot ping a target because you are receiving no response or a response that states the destination is unreachable, then ICMP may be disabled on the remote end. If you wanted to elicit a response from a host using TCP, what tool would you use?
A. Traceroute
B. Broadcast Ping
C. Ptunnel
D. Hping
D. Hping
A small business recently experienced a catastrophic data loss due to flooding from a recent hurricane. The customer had no backups, and flooding destroyed all of the hardware associated with the small business. As part of the rebuilding process, the small business contracts with your company to help create a disaster recovery plan to ensure this never reoccurs again. Which of the following recommendations should you include as part of the disaster recovery plan?
A. Local backups should be conducted
B. Backups should be conducted to cloud based
C. Locals backups should be verified
D. Purchase waterproof devices
C. Locals backups should be verified
(Sample Simulation – On the real exam for this type of question, you would have to rearrange the steps into the proper order by dragging and dropping them into place.)
A. Hard Drive or USB Drive, Swap File, Random Access Memory, Processor Cache
B. Processor Cache, Random Access Memory, Swap Files, Hard Drive or USB Drive
B. Processor Cache, Random Access Memory, Swap Files, Hard Drive or USB Drive
OBJ-4.5: The correct order for evidence collection based on the order of volatility is the Processor Cache, Random Access Memory, Swap File, and then the Hard Drive or USB Drive. Since the Processor Cache is the most volatile and changes the most frequently, it should be captured first. Random Access Memory (RAM) is temporary storage on a computer. It can quickly change or be overwritten, and the information stored in RAM is lost when power is removed from the computer, so it should be collected second. Swap files are temporary files on a hard disk used as virtual memory, and therefore, they should be collected third. The files on a hard disk or USB drive are the least volatile of the four options presented since they are used for long-term storage of data and are not lost when the computer loses power.
What tool can be used as an exploitation framework during your penetration tests?
A. Autopsy
B. Nmap
C. Metasploit
D. Nessus
C. Metasploit
Which of the following security controls provides Windows system administrators with an efficient way to deploy system configuration settings across many devices?
A. HIPS
B. Anti- Maware
C. GPO
D. Patch Management
C. GPO
You are conducting an intensive vulnerability scan to detect which ports might be open to exploitation. During the scan, one of the network services becomes disabled and impacts the production server. Which of the following sources of information would provide you with the most relevant information for you to use in determining which network service was interrupted and why?
A. NIDS
B. Firewall Logs
C. Syslog
D. Network Mapping
C. Syslog
You have run a vulnerability scan and received the following output: Which of the following categories should this be classified as?
A. VPN Visibility
B. Active Directory Encryption vulnerability
C. Web Application cryptography vulnerability
D. PKI Transfer
C. Web Application cryptography vulnerability
OBJ-4.3: This vulnerability should be categories as a web application cryptographic vulnerability. This is shown by the weak SSLv3.0/TLSv1.0 protocol being used in cipher block chaining (CBC) mode. Specifically, the use of the 3DES and DES algorithms during negotiation is a significant vulnerability. A stronger protocol should be used, such as forcing the use of AES.
What containment technique is the strongest possible response to an incident?
A. Isolating the Attacker
B. Isolating affected systems
C. Segmentation
D. Enumeration
B. Isolating affected systems
A cybersecurity analyst is attempting to classify network traffic within an organization. The analyst runs the tcpdump command and receives the following output: Which of the following statements is true based on this output?
A. 10.10.19.121 is under attack
B. 10.10.19.121 is client
C. 11.54.12.121 is under ataack
D. 11.54.12.121 is client
B. 10.10.19.121 is client
Explanation
OBJ-4.1: This output from the tcpdump command is displaying three packets in a larger sequence of events. Based solely on these three packets, we can only be certain that the server (11.154.12.121) runs an SSH server over port 22. This is based on the first line of the output. The second and third lines are the server responding to the request and sending data back to the client (10.0.19.121) over port 52497. There is no evidence of an attack against either the server or the client based on this output since we can only see the headers and not the content being sent between the client and server.
Which of the following proprietary tools is used to create forensic disk images without making changes to the original evidence?
A. Autopsy
B. Memdump
C. dd
D. FTK Imager
D. FTK Imager
A penetration tester has issued the following command on a victimized host: nc -l -p 8080 | nc 192.168.1.76 443. What will occur based on this command?
A. Netcat will listen to port 8080 received on remote connection
B. Netcat will listen for connection from 192.168.1..76
C. Netcat will listen to port 8080 than output
D. Netcat will listen on the 192.168.1..76
A. Netcat will listen to port 8080 received on remote connection
What type of weakness is John the Ripper used to test during a technical assessment?
A. File Permission
B. Passwords
C. Usernames
D. Firewall Rulesets
B. Passwords
What problem can you solve by using Wireshark?
A. Resetting the admin password
B. Validating the creation dates
C. Performing packet capture
D. Tracking source code
C. Performing packet capture
You are an analyst and have been asked to review and categorize the following output from a packet analysis in Wireshark: Based on your review, what does this scan indicate?
A. 192.168.3.145 might be infected with malware
B. 192.168.3.145 might be infected with malware and beaconing to a C2 sever
C. This appears to be a normal network
D. 173.12.15.23 might be infected with malware and beaconing to a C2 sever
E. 173.12.15.23 might be infected with malware
C. This appears to be a normal network
OBJ-4.1: This appears to be normal network traffic. The first line shows that a DNS lookup was performed for a website (test.diontraining.com). The second line shows the response from the DNS server with the IP address of the website. The third line begins a three-way handshake between an internal host and the website. The fourth line is the SYN-ACK response from the website to the internal host as part of this handshake. The fifth line is a standard Windows NetBIOS query within the local area network to translate human-readable names to local IP addresses. The sixth and seventh lines appear to be inbound requests to port 443 and port 8080, both of which were sent the RST by the internal host’s firewall since it is not running those services on the host. None of this network traffic appears to be suspicious.
You are analyzing the logs of a forensic analysts workstation and see the following: What does the bs=1M signify in the command list above?
A. Set the beginner sector
B. Send output to a blank sector
C. REmove error messages
D. Set the Block Size
D. Set the Block Size
OBJ-4.1: The dd command is used in forensic data acquisition to forensically create a bit by bit copy of a hard drive to a disk image. The bs operator sets the block size when using the Linux dd command. This question may seem beyond the scope of the exam. Still, the objectives allow for “other examples of technologies, processes, or tasks about each objective may also be included on the exam although not listed or covered” in the objectives’ bulletized lists. The content examples listed in the objectives are meant to clarify the test objectives and should not be construed as a comprehensive listing of this examination’s content. Therefore, questions like this are fair game on test day. That said, your goal isn’t to score 100% on the exam; it is to pass it. Don’t let questions like this throw you off on test day. If you aren’t sure, take your best guess and move on!
An analyst just completed a port scan and received the following results of open ports: Based on these scan results, which of the following services are NOT currently operating?
A. Web
B. Database
C. SSH
D. RDP
C. SSH
OBJ-4.3: Based on the port numbers shown as open in the nmap scan results, SSH is not currently operating. SSH operates over port 22. Web servers use port 80 for HTTP and 443 for HTTPS. Database servers run on port 1433 (Microsoft SQL) or 3306 (MySQL). Remote Desktop Protocol runs on port 3389.
