QUESTION 53
Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an incident to her for further investigation and confirmation. Charline, after a thorough investigation, confirmed the incident and assigned it with an initial priority.
What would be her next action according to the SOC workflow?

QUESTION 54
The Syslog message severity levels are labelled from level 0 to level 7.
What does level 0 indicate?

QUESTION 55
Which of the following formula represents the risk levels?

QUESTION 56
Which of the following formula is used to calculate the EPS of the organization?

QUESTION 57
Which of the following formula represents the risk levels?

QUESTION 58
Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.

What does this event log indicate?

QUESTION 59
John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is coming.
Which of the following data source will he use to prepare the dashboard?

QUESTION 60
InfoSystem LLC, a US-based company, is establishing an in-house SOC. John has been given the responsibility to finalize strategy, policies, and procedures for the SOC.
Identify the job role of John.

QUESTION 61
Which of the following contains the performance measures, and proper project and time management details?

QUESTION 62
According to the Risk Matrix table, what will be the risk level when the probability of an attack is very high, and the impact of that attack is major?
NOTE: It is mandatory to answer the question before proceeding to the next one.

QUESTION 63
Which of the log storage method arranges event logs in the form of a circular buffer?

QUESTION 64
Jony, a security analyst, while monitoring IIS logs, identified events shown in the figure below.

What does this event log indicate?

QUESTION 65
Harley is working as a SOC analyst with Powell Tech. Powell Inc. is using Internet Information Service (IIS) version 7.0 to host their website.
Where will Harley find the web server logs, if he wants to investigate them for any anomalies?

QUESTION 66
Which of the following attack can be eradicated by disabling of “allow_url_fopen and allow_url_include” in the php.ini file?

QUESTION 67
In which phase of Lockheed Martin’s – Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?

QUESTION 68
John, a SOC analyst, while monitoring and analyzing Apache web server logs, identified an event log matching Regex /(.|(%|%25)2E)(.|(%|%25)2E)(/|(%|%25)2F||(%|%25)5C)/i.
What does this event log indicate?

QUESTION 69
Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.

QUESTION 70
Bonney’s system has been compromised by a gruesome malware.
What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

QUESTION 71
Which of the following are the responsibilities of SIEM Agents?
1.Collecting data received from various devices sending data to SIEM before forwarding it to the central engine.
2.Normalizing data received from various devices sending data to SIEM before forwarding it to the central engine.
3.Co-relating data received from various devices sending data to SIEM before forwarding it to the central engine.
4.Visualizing data received from various devices sending data to SIEM before forwarding it to the central engine.

QUESTION 72
Which of the following factors determine the choice of SIEM architecture?

QUESTION 73
Which of the following command is used to view iptables logs on Ubuntu and Debian distributions?

QUESTION 74
Chloe, a SOC analyst with Jake Tech, is checking Linux systems logs. She is investigating files at /var/log/ wtmp.
What Chloe is looking at?

QUESTION 75
Sam, a security analyst with INFOSOL INC., while monitoring and analyzing IIS logs, detected an event matching regex /w*((%27)|(‘))((%6F)|o|(%4F))((%72)|r|(%52))/ix.
What does this event log indicate?