CREST CPTIA Value Pack (Frequently Bought Together)

Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive data. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?

• A. Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
• B. Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
• C. Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
• D. Jim should identify the attack at an initial stage by checking the content of the user agent field.

QualTech Solutions is a leading security services enterprise. Dickson, who works as an incident responder with this firm, is performing a vulnerability assessment to identify the security problems in the network by using automated tools for identifying the hosts, services, and vulnerabilities in the enterprise network. In the above scenario, which of the following types of vulnerability assessment is Dickson performing?

• A. Passive assessment
• B. External assessment
• C. Internal assessment
• D. Active assessment

An organization suffered many major attacks and lost critical information, such as employee records, and financial information. Therefore, the management decides to hire a threat analyst to extract the strategic threat intelligence that provides high-level information regarding current cyber-security posture, threats, details on the financial impact of various cyber-activities, and so on.
Which of the following sources will help the analyst to collect the required intelligence?

• A. OSINT, CTI vendors, ISAO/ISACs
• B. Campaign reports, malware, incident reports, attack group reports, human intelligence
• C. Active campaigns, attacks on other organizations, data feeds from external third parties
• D. Human, social media, chat rooms

XYZ Inc. was affected by a malware attack and James, being the incident handling and response (IH&R) team personnel handling the incident, found out that the root cause of the incident is a backdoor that has bypassed the security perimeter due to an existing vulnerability in the deployed firewall. James had contained the spread of the infection and removed the malware completely. Now the organization asked him to perform incident impact assessment to identify the impact of the incident over the organization and he was also asked to prepare a detailed report of the incident.
Which of the following stages in IH&R process is James working on?

• A. Post-incident activities
• B. Eradication
• C. Notification
• D. Evidence gathering and forensics analysis

Eric works as a system administrator at ABC organization and previously granted several users with access privileges to the organizations systems with unlimited permissions. These privileged users could prospectively misuse their rights unintentionally, maliciously, or could be deceived by attackers that could trick them to perform malicious activities. Which of the following guidelines would help incident handlers eradicate insider attacks by privileged users?

• A. Do not use encryption methods to prevent, administrators and privileged users from accessing backup tapes and sensitive information
• B. Do not enable default administrative accounts to ensure accountability
• C. Do not allow administrators to use unique accounts during the installation process
• D. Do not control the access to administrator ano privileged users