200-201 Exam Dumps | A company had a recent breach and lost confidential data to a competitor. An internal investigation found

<< Prev Question Next Question >>

Question 5/208

A company had a recent breach and lost confidential data to a competitor. An internal investigation found out that a new junior accounting specialist logged in to the accounting server with their user ID and stole confidential data. The junior accounting specialist denies the action and claims that the attempt was done by someone else. During court proceedings, the company presents logs and CCTV camera recordings that show the malicious insider in action. Which type of evidence has the company presented?

A. corroborative and substantive

B. circumstantial and direct

C. direct and corroborative

D. indirect and corroborative

Question List (208q): Question 1: What is the purpose of command and control for network-aware...; Question 2: Refer to the exhibit. (Exhibit) A security analyst is invest...; Question 3: A security specialist notices 100 HTTP GET and POST requests...; Question 4: Which option describes indicators of attack?...; Question 5: A company had a recent breach and lost confidential data to ...; Question 6: A security expert is working on a copy of the evidence, an I...; Question 7: The security team has detected an ongoing spam campaign targ...; Question 8: Which two components reduce the attack surface on an endpoin...; Question 9: Which information must an organization use to understand the...; Question 10: Which type of data is used to detect anomalies in the networ...; Question 11: What is a description of a social engineering attack?...; Question 12: Which security principle is violated by running all processe...; Question 13: The SOC team has confirmed a potential indicator of compromi...; Question 14: Refer to the exhibit. (Exhibit) What is depicted in the exhi...; Question 15: Refer to the exhibit. (Exhibit) What is the potential threat...; Question 16: A CMS plugin creates two files that are accessible from the ...; Question 17: An engineer needs to discover alive hosts within the 192.168...; Question 18: Which regular expression matches "color" and "colour"?...; Question 19: Which NIST IR category stakeholder is responsible for coordi...; Question 20: Refer to the exhibit. (Exhibit) What is the outcome of the c...; Question 21: What is the virtual address space for a Windows process?...; Question 22: What are the two differences between vulnerability and explo...; Question 23: Refer to the exhibit. (Exhibit) Which type of evidence is th...; Question 24: What is an advantage of symmetric over asymmetric encryption...; Question 25: What describes the impact of false-positive alerts compared ...; Question 26: Refer to the exhibit. (Exhibit) A workstation downloads a ma...; Question 27: Why is HTTPS traffic difficult to screen?...; Question 28: Which vulnerability type is used to read, write, or erase in...; Question 29: What is the difference between a threat and an exploit?...; Question 30: Which action prevents buffer overflow attacks?...; Question 31: Refer to the exhibit. (Exhibit) What is the expected result ...; Question 32: What is a sandbox interprocess communication service?...; Question 33: A network engineer informed a security team of a large amoun...; Question 34: An organization is cooperating with several third-party comp...; Question 35: What is a scareware attack?; Question 36: An organization has recently adjusted its security stance in...; Question 37: Which utility blocks a host portscan?...; Question 38: Refer to the exhibit. (Exhibit) An attacker scanned the serv...; Question 39: What is the practice of giving employees only those permissi...; Question 40: An engineer received a ticket to investigate a potentially m...; Question 41: Refer to the exhibit. (Exhibit) Which application-level prot...; Question 42: Why should an engineer use a full packet capture to investig...; Question 43: A security incident occurred with the potential of impacting...; Question 44: Refer to the exhibit. (Exhibit) What does this output indica...; Question 45: What is the communication channel established from a comprom...; Question 46: What is the difference between the rule-based detection when...; Question 47: Refer to the exhibit (Exhibit) An engineer is analyzing DNS ...; Question 48: What does cyber attribution identify in an investigation?...; Question 49: Which open-sourced packet capture tool uses Linux and Mac OS...; Question 50: An analyst received a ticket about degraded processing capab...; Question 51: What is the difference between attack surface and vulnerabil...; Question 52: Refer to the exhibit. (Exhibit) Refer to the exhibit. A secu...; Question 53: Refer to the exhibit. (Exhibit) Refer to the exhibit A penet...; Question 54: What is a difference between SIEM and SOAR?...; Question 55: An analyst received a ticket regarding a degraded processing...; Question 56: Refer to the exhibit. (Exhibit) What must be interpreted fro...; Question 57: An engineer runs a suspicious file in a sandbox analysis too...; Question 58: An analyst received an alert on their desktop computer showi...; Question 59: What makes HTTPS traffic difficult to monitor?...; Question 60: Refer to the exhibit. (Exhibit) What is occurring within the...; Question 61: What is sliding window anomaly detection?...; Question 62: According to the September 2020 threat intelligence feeds a ...; Question 63: Which list identifies the information that the client sends ...; Question 64: Refer to the exhibit. (Exhibit) Refer to the exhibit. An eng...; Question 65: What is a difference between tampered and untampered disk im...; Question 66: What describes the concept of data consistently and readily ...; Question 67: What are two differences in how tampered and untampered disk...; Question 68: What is a disadvantage of the asymmetric encryption system?...; Question 69: How is NetFlow different from traffic mirroring?...; Question 70: What technology should be used for the verified and secure e...; Question 71: Which two elements of the incident response process are stat...; Question 72: Which statement describes indicators of attack?...; Question 73: Refer to the exhibit. (Exhibit) Which type of log is display...; Question 74: Refer to the exhibit. (Exhibit) Which type of attack is bein...; Question 75: Which evasion technique is a function of ransomware?...; Question 76: Which incidence response step includes identifying all hosts...; Question 77: A company receptionist received a threatening call referenci...; Question 78: A security engineer must protect the company from known issu...; Question 79: What is a difference between signature-based and behavior-ba...; Question 80: Which signature impacts network traffic by causing legitimat...; Question 81: Refer to the exhibit. (Exhibit) During the analysis of a sus...; Question 82: Which action matches the weaponization step of the Cyber Kil...; Question 83: Refer to the exhibit. (Exhibit) What is occurring?...; Question 84: What is the difference between mandatory access control (MAC...; Question 85: Refer to the exhibit. (Exhibit) Refer to the exhibit Which T...; Question 86: An analyst discovers that a legitimate security alert has be...; Question 87: An engineer is addressing a connectivity issue between two s...; Question 88: What is an attack surface as compared to a vulnerability?...; Question 89: What are indicators of attack?; Question 90: Refer to the exhibit. (Exhibit) An engineer received a ticke...; Question 91: What describes the public key infrastructure (PKI)?...; Question 92: What is a difference between inline traffic interrogation an...; Question 93: What is a difference between authorization and authenticatio...; Question 94: What is indicated by an increase in IPv4 traffic carrying pr...; Question 95: Which attack represents the evasion technique of resource ex...; Question 96: Which of these is a defense-in-depth strategy principle?...; Question 97: What is an incident response plan?...; Question 98: Syslog collecting software is installed on the server For th...; Question 99: Refer to the exhibit. (Exhibit) An engineer is analyzing thi...; Question 100: What are the two characteristics of the full packet captures...; Question 101: What is obtained using NetFlow?...; Question 102: Which technology on a host is used to isolate a running appl...; Question 103: A software development company develops high-end technology ...; Question 104: What is threat hunting?; Question 105: What is a difference between tampered and untampered disk im...; Question 106: What is the functionality of an IDS'?...; Question 107: A security engineer has a video of a suspect entering a data...; Question 108: What matches the regular expression c(rgr)+e?...; Question 109: Which regular expression is needed to capture the IP address...; Question 110: An engineer needs to fetch logs from a proxy server and gene...; Question 111: What is the advantage of agent-based protection compared to ...; Question 112: A user received an email attachment named "Hr405-report2609-...; Question 113: Refer to the exhibit. (Exhibit) Refer to the exhibit. An eng...; Question 114: Which event is user interaction?...; Question 115: A SOC analyst is investigating an incident that involves a L...; Question 116: Which element is included in an incident response plan as st...; Question 117: What is session data used for in network security?...; Question 118: Drag and drop the event term from the left onto the descript...; Question 119: Refer to the exhibit. (Exhibit) Which application protocol i...; Question 120: Which technique is a low-bandwidth attack?...; Question 121: Which regular expression matches loopback IP address (127.0....; Question 122: Refer to the exhibit. (Exhibit) Refer to the exhibit. The fi...; Question 123: Which data capture includes payload and header information?...; Question 124: Which CVSS metric group identifies other components that are...; Question 125: What is the practice of giving an employee access to only th...; Question 126: An engineer received an alert affecting the degraded perform...; Question 127: Refer to the exhibit. (Exhibit) Which two elements in the ta...; Question 128: An engineer configured regular expression "."\.(pd][Oo][Cc)|...; Question 129: What is a difference between rule-based and role-based acces...; Question 130: An organization's security team detected network spikes comi...; Question 131: How low does rule-based detection differ from behavioral det...; Question 132: During which phase of the forensic process is data that is r...; Question 133: What does this regular expression do? 192|172).(168|1[6-9]|2...; Question 134: Which type of attack involves sending input commands to a we...; Question 135: What specific type of analysis is assigning values to the sc...; Question 136: Refer to exhibit. (Exhibit) An analyst performs the analysis...; Question 137: How does an attacker observe network traffic exchanged betwe...; Question 138: According to CVSS, what is a description of the attack vecto...; Question 139: What is the role of indicator of compromise in an investigat...; Question 140: How does TOR alter data content during transit?...; Question 141: Refer to the exhibit. (Exhibit) A company employee is connec...; Question 142: Which difficulty occurs when log messages are compared from ...; Question 143: Why is encryption challenging to security monitoring?...; Question 144: When trying to evade IDS/IPS devices, which mechanism allows...; Question 145: What is the difference between the ACK flag and the RST flag...; Question 146: Which event artifact is used to identify HTTP GET requests f...; Question 147: An engineer needs to configure network systems to detect com...; Question 148: Which data format is the most efficient to build a baseline ...; Question 149: Drag and drop the data source from the left onto the data ty...; Question 150: Refer to the exhibit. (Exhibit) Which packet contains a file...; Question 151: Refer to exhibit. (Exhibit) An engineer is Investigating an ...; Question 152: Refer to the exhibit. (Exhibit) What is occurring in this ne...; Question 153: An engineer needs to have visibility on TCP bandwidth usage,...; Question 154: What is a difference between a threat and a risk?...; Question 155: An engineer must investigate suspicious connections. Data ha...; Question 156: How is attacking a vulnerability categorized?...; Question 157: How does agentless monitoring differ from agent-based monito...; Question 158: At a company party a guest asks questions about the company'...; Question 159: How is SQL injection prevented?...; Question 160: A security engineer must investigate a recent breach within ...; Question 161: What causes events on a Windows system to show Event Code 46...; Question 162: Drag and drop the definitions from the left onto the phases ...; Question 163: When communicating via TLS, the client initiates the handsha...; Question 164: Which SOC metric represents the time to stop the incident fr...; Question 165: What is an example of social engineering attacks?...; Question 166: Refer to the exhibit. (Exhibit) Refer to the exhibit. A SOC ...; Question 167: An automotive company provides new types of engines and spec...; Question 168: Refer to the exhibit. (Exhibit) Which stakeholders must be i...; Question 169: Refer to the exhibit. (Exhibit) Refer to the exhibit. A SOC ...; Question 170: A system administrator is ensuring that specific registry in...; Question 171: An investigator is examining a copy of an ISO file that is s...; Question 172: A security analyst notices a sudden surge of incoming traffi...; Question 173: Refer to the exhibit. (Exhibit) An analyst received this ale...; Question 174: Refer to the exhibit. (Exhibit) What does the message indica...; Question 175: Refer to the exhibit. (Exhibit) Refer to the exhibit. An emp...; Question 176: What are the two differences between stateful and deep packe...; Question 177: An analyst is investigating an incident in a SOC environment...; Question 178: Refer to the exhibit. (Exhibit) A suspicious IP address is t...; Question 179: Drag and drop the access control models from the left onto t...; Question 180: How does an SSL certificate impact security between the clie...; Question 181: Refer to the exhibit. (Exhibit) Which component is identifia...; Question 182: Refer to the exhibit. (Exhibit) What is the potential threat...; Question 183: Drag and drop the technology on the left onto the data type ...; Question 184: Which evasion method is being used when TLS is observed betw...; Question 185: What is the impact of false positive alerts on business comp...; Question 186: Which two pieces of information are collected from the IPv4 ...; Question 187: Refer to the exhibit. (Exhibit) Which event is occurring?...; Question 188: Which two elements are assets in the role of attribution in ...; Question 189: What is a purpose of a vulnerability management framework?...; Question 190: A security engineer deploys an enterprise-wide host/endpoint...; Question 191: Which principle reduces the risk of attackers gaining access...; Question 192: Which tool gives the ability to see session data in real tim...; Question 193: Refer to the exhibit. (Exhibit) Refer to the exhibit. An eng...; Question 194: What does the SOC metric MTTC provide in incident analysis'?...; Question 195: How does an attack surface differ from an attack vector?...; Question 196: How does statistical detection differ from rule-based detect...; Question 197: Refer to the exhibit. (Exhibit) Refer to the exhibit. Based ...; Question 198: What is corroborating evidence?...; Question 199: Which action matches the weaponization step of the Cyber Kil...; Question 200: Which metric is used to capture the level of access needed t...; Question 201: What is the impact of encapsulation on the network?...; Question 202: What are two differences between tampered disk images and un...; Question 203: Refer to the exhibit. (Exhibit) Refer to the exhibit. What t...; Question 204: What should a security analyst consider when comparing inlin...; Question 205: Refer to the exhibit. (Exhibit) An attacker gained initial a...; Question 206: If a web server accepts input from the user and passes it to...; Question 207: What is a difference between SI EM and SOAR security systems...; Question 208: Which of these describes SOC metrics in relation to security...

Question 5/208

LEAVE A REPLY

Download PDF File