CS0-001 Exam Dumps | A security operations team was alerted to abnormal DNS activity coming from a user's machine. The team

<< Prev Question Next Question >>

Question 29/173

A security operations team was alerted to abnormal DNS activity coming from a user's machine. The team performed a forensic investigation and discovered a host had been compromised. Malicious code was using DNS as a tunnel to extract data from the client machine, which had been leaked and transferred to an unsecure public Internet site. Which of the following BEST describes the attack?

A. Phishing

B. Cache poisoning

C. Data exfiltration

D. Pharming

Question List (173q): Question 1: A technician receives a report that a user's workstation is ...; 2 commentQuestion 2: An analyst is troubleshooting a PC that is experiencing high...; Question 3: Which of the following is a vulnerability when using Windows...; Question 4: A security analyst is conducting a vulnerability assessment ...; Question 5: An analyst was tasked with providing recommendations of tech...; Question 6: Which of the following represent the reasoning behind carefu...; Question 7: An organization wants to remediate vulnerabilities associate...; Question 8: External users are reporting that a web application is slow ...; Question 9: A security analyst is performing a review of Active Director...; Question 10: A security analyst is assisting with a computer crime invest...; Question 11: A systems administrator is trying to secure a critical syste...; Question 12: A vulnerability scan returned the following results for a we...; Question 13: A list of vulnerabilities has been reported in a company's m...; Question 14: An analyst is observing unusual network traffic from a works...; Question 15: The director of software development is concerned with recen...; Question 16: In order to leverage the power of data correlation within Ne...; Question 17: After analyzing and correlating activity from multiple senso...; Question 18: A company's computer was recently infected with ransomware. ...; Question 19: Following a recent security breach, a post-mortem was done t...; Question 20: A security analyst has been asked to scan a subnet. During t...; Question 21: A cybersecurity analyst has received an alert that well-know...; Question 22: During a web application vulnerability scan, it was discover...; Question 23: Creating an isolated environment in order to test and observ...; Question 24: A company that is hiring a penetration tester wants to exclu...; 1 commentQuestion 25: A security analyst is reviewing the following log after enab...; Question 26: A network administrator is attempting to troubleshoot an iss...; Question 27: An analyst reviews a recent report of vulnerabilities on a c...; Question 28: The primary difference in concern between remediating identi...; Question 29: A security operations team was alerted to abnormal DNS activ...; Question 30: A nuclear facility manager determined the need to monitor ut...; Question 31: While reviewing proxy logs, the security analyst noticed a s...; Question 32: An analyst is preparing for a technical security compliance ...; Question 33: A security analyst is reviewing IDS logs and notices the fol...; Question 34: A company has received the results of an external vulnerabil...; Question 35: A company has several internal-only, web-based applications ...; Question 36: After an internal audit, it was determined that administrati...; Question 37: A project lead is reviewing the statement of work for an upc...; Question 38: A security incident has been created after noticing unusual ...; Question 39: Given a packet capture of the following scan: (Exhibit) Whic...; Question 40: A security analyst begins to notice the CPU utilization from...; Question 41: A security analyst has discovered that an outbound SFTP proc...; 2 commentQuestion 42: A company installed a wireless network more than a year ago,...; Question 43: The business has been informed of a suspected breach of cust...; Question 44: A company allows employees to work remotely. The security ad...; Question 45: A computer has been infected with a virus and is sending out...; Question 46: Which of the following policies BEST explains the purpose of...; Question 47: A security audit revealed that port 389 has been used instea...; Question 48: Which of the following is MOST effective for correlation ana...; Question 49: A security analyst is adding input to the incident response ...; Question 50: While a threat intelligence analyst was researching an indic...; Question 51: A vulnerability analyst needs to identify all systems with u...; Question 52: Which of the following organizations would have to remediate...; Question 53: A cybersecurity analyst traced the source of an attack to co...; Question 54: The security operations team is conducting a mock forensics ...; Question 55: A security analyst with an international response team is wo...; Question 56: Alerts have been received from the SIEM, indicating infectio...; Question 57: A security analyst is concerned that unauthorized users can ...; Question 58: A security analyst has determined the security team should t...; Question 59: A security analyst has noticed an alert from the SIEM. A wor...; Question 60: A cybersecurity analyst has received a report that multiple ...; Question 61: An organization is conducting penetration testing to identif...; Question 62: Which of the following is a technology used to provide Inter...; Question 63: After scanning the main company's website with the OWASP ZAP...; Question 64: Which of the following systems would be at the GREATEST risk...; Question 65: While preparing for a third-party audit, the vice president ...; Question 66: An analyst has initiated an assessment of an organization's ...; Question 67: A cybersecurity analyst is completing an organization's vuln...; Question 68: A recent audit has uncovered several coding errors and a lac...; Question 69: A company invested ten percent of its entire annual budget i...; Question 70: A security analyst received a compromised workstation. The w...; Question 71: A database administrator contacts a security administrator t...; Question 72: A security analyst received several service tickets reportin...; Question 73: A cybersecurity analyst has received the laptop of a user wh...; Question 74: A cybersecurity analyst is reviewing Apache logs on a web se...; Question 75: Organizational policies require vulnerability remediation on...; Question 76: A security analyst is reviewing a report from the networking...; Question 77: A newly discovered malware has a known behavior of connectin...; Question 78: The Chief Information Security Officer (CISO) has asked the ...; Question 79: Which of the following could be directly impacted by an unpa...; Question 80: A cybersecurity analyst has several SIEM event logs to revie...; Question 81: A Linux-based file encryption malware was recently discovere...; Question 82: A security analyst has just completed a vulnerability scan o...; Question 83: A security analyst is performing ongoing scanning and contin...; Question 84: While reviewing firewall logs, a security analyst at a milit...; Question 85: Which of the following utilities could be used to resolve an...; Question 86: A security analyst is concerned that employees may attempt t...; Question 87: An analyst finds that unpatched servers have undetected vuln...; Question 88: An application development company released a new version of...; Question 89: Due to new regulations, a company has decided to institute a...; Question 90: A security analyst is preparing for the company's upcoming a...; Question 91: Which of the following countermeasures should the security a...; Question 92: A cybersecurity analyst is reviewing the following outputs: ...; Question 93: NOTE: Question IP must be 192.168.192.123 During a network r...; Question 94: A security analyst notices PII has been copied from the cust...; Question 95: An analyst was testing the latest version of an internally d...; Question 96: Which of the following are essential components within the r...; Question 97: An analyst wants to use a command line tool to identify open...; Question 98: A new policy requires the security team to perform web appli...; Question 99: After running a packet analyzer on the network, a security a...; Question 100: A cybersecurity consultant found common vulnerabilities acro...; Question 101: An organization wants to harden its web servers. As part of ...; Question 102: A SIEM analyst noticed a spike in activities from the guest ...; Question 103: A company provides wireless connectivity to the internal net...; Question 104: Three similar production servers underwent a vulnerability s...; Question 105: A security analyst is reviewing packet captures for a specif...; Question 106: Which of the following stakeholders would need to be aware o...; Question 107: While reviewing web server logs, a security analyst notices ...; Question 108: During a routine review of firewall logs, an analyst identif...; Question 109: While conducting research on malicious domains, a threat int...; Question 110: A cyber incident response team finds a vulnerability on a co...; Question 111: A security analyst is reviewing packet captures to determine...; Question 112: A recent audit included a vulnerability scan that found crit...; Question 113: After completing a vulnerability scan, the following output ...; Question 114: Which of the following commands would a security analyst use...; Question 115: A company has decided to process credit card transactions di...; Question 116: A threat intelligence feed has posted an alert stating there...; Question 117: After implementing and running an automated patching tool, a...; Question 118: A cybersecurity analyst wants to use ICMP ECHO_REQUESTon a m...; Question 119: In order to the leverage the power of data correlation with ...; Question 120: A technician receives the following security alert from the ...; Question 121: A business-critical application is unable to support the req...; Question 122: A software patch has been released to remove vulnerabilities...; Question 123: A security analyst is reviewing output from a CVE-based vuln...; Question 124: A software development company in the manufacturing sector h...; Question 125: A cybersecurity professional typed in a URL and discovered t...; Question 126: Given the following output from a Linux machine: file2cable ...; Question 127: The security configuration management policy states that all...; Question 128: After reading about data breaches at a competing company, se...; Question 129: A security analyst has created an image of a drive from an i...; Question 130: The help desk informed a security analyst of a trend that is...; Question 131: A cybersecurity analyst is conducting packet analysis on the...; Question 132: A malware infection spread to numerous workstations within t...; Question 133: An employee at an insurance company is processing claims tha...; Question 134: A security analyst was asked to join an outage call for a cr...; Question 135: A pharmacy gives its clients online access to their records ...; Question 136: In an effort to be proactive, an analyst has run an assessme...; Question 137: A security analyst has noticed that a particular server has ...; Question 138: A penetration tester is preparing for an audit of critical s...; Question 139: A cybersecurity analyst is reviewing the current BYOD securi...; Question 140: A security administrator has uncovered a covert channel used...; Question 141: A technician is running an intensive vulnerability scan to d...; Question 142: While reviewing three months of logs, a security analyst not...; Question 143: A system administrator has reviewed the following output: (E...; Question 144: A company has implemented WPA2, a 20-character minimum for t...; Question 145: A company's asset management software has been discovering a...; Question 146: When network administrators observe an increased amount of w...; Question 147: Which of the following best practices is used to identify ar...; Question 148: An HR employee began having issues with a device becoming un...; Question 149: File integrity monitoring states the following files have be...; Question 150: A production web server is experiencing performance issues. ...; Question 151: An insurance company employs quick-response team drivers tha...; Question 152: A logistics company's vulnerability scan identifies the foll...; Question 153: On which of the following organizational resources is the la...; Question 154: A security analyst has determined that the user interface on...; Question 155: Law enforcement has contacted a corporation's legal counsel ...; Question 156: As part of an upcoming engagement for a client, an analyst i...; Question 157: An executive tasked a security analyst to aggregate past log...; Question 158: Joe, an analyst, has received notice that a vendor who is co...; Question 159: A security analyst is making recommendations for securing ac...; Question 160: A security administrator determines several months after the...; Question 161: An organization wants to remediate vulnerabilities associate...; Question 162: Which of the following tools should an analyst use to scan f...; Question 163: Given the following log snippet: (Exhibit) Which of the foll...; Question 164: A cybersecurity analyst is currently investigating a server ...; Question 165: Given the following code: (Exhibit) Which of the following t...; Question 166: Company A's security policy states that only PKI authenticat...; Question 167: The development team currently consists of three developers ...; Question 168: A cybersecurity analyst was asked to discover the hardware a...; Question 169: A company decides to move three of its business applications...; Question 170: An organization is experiencing degradation of critical serv...; Question 171: An organization has a policy prohibiting remote administrati...; Question 172: In order to meet regulatory compliance objectives for the st...; Question 173: Which of the following principles describes how a security a...

Question 29/173

LEAVE A REPLY

Download PDF File