NO.41 An “unknown error code” is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter agent logs shows no connectivity errors. What is the next log file the engineer should check to continue troubleshooting this error?

NO.42 Refer to the exhibit.

Which type of code created the snippet?

NO.43 Refer to the exhibit.

What is the indicator of compromise?

NO.44 What is the transmogrify anti-forensics technique?

NO.45

multiple machines behave abnormally. A sandbox analysis reveals malware. What must the administrator determine next?

NO.46 An employee receives an email from a “trusted” person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis?

NO.47 Refer to the exhibit.

NO.48 Refer to the exhibit.

A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

NO.49 What is an issue with digital forensics in cloud environments, from a security point of view?

NO.50 Snort detects traffic that is targeting vulnerabilities in files that belong to software in the Microsoft Office suite. On a SIEM tool, the SOC analyst sees an alert from Cisco FMC. Cisco FMC is implemented with Snort IDs. Which alert message is shown?

NO.51 Which tool is used for reverse engineering malware?

NO.52 Refer to the exhibit.

An employee notices unexpected changes and setting modifications on their workstation and creates an incident ticket. A support specialist checks processes and services but does not identify anything suspicious.
The ticket was escalated to an analyst who reviewed this event log and also discovered that the workstation had multiple large data dumps on network shares. What should be determined from this information?

NO.53 A cybersecurity analyst must identify an unknown service causing high CPU on a Windows server. What tool should be used?

NO.54 Which issue is related to gathering evidence from cloud vendors?

NO.55 An “unknown error code” is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter agent logs shows no connectivity errors. What is the next log file the engineer should check to continue troubleshooting this error?

NO.56 Refer to the exhibit.

Which encoding technique is represented by this HEX string?

NO.57 Refer to the exhibit.

A company that uses only the Unix platform implemented an intrusion detection system. After the initial configuration, the number of alerts is overwhelming, and an engineer needs to analyze and classify the alerts.
The highest number of alerts were generated from the signature shown in the exhibit. Which classification should the engineer assign to this event?

NO.58

NO.59 Refer to the exhibit.

Which element in this email is an indicator of attack?

NO.60

Refer to the exhibit. An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hour prior. Which two indicators of compromise should be determined from this information?
(Choose two.)

NO.61 An organization uses a Windows 7 workstation for access tracking in one of their physical data centers on which a guard documents entrance/exit activities of all personnel. A server shut down unexpectedly in this data center, and a security specialist is analyzing the case. Initial checks show that the previous two days of entrance/exit logs are missing, and the guard is confident that the logs were entered on the workstation. Where should the security specialist look next to continue investigating this case?

NO.62

Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?

NO.63 Which type of record enables forensics analysts to identify fileless malware on Windows machines?

NO.64 An investigator is analyzing an attack in which malicious files were loaded on the network and were undetected. Several of the images received during the attack include repetitive patterns. Which anti-forensic technique was used?