Security analysts are conducting an investigation of an attack that occurred inside the organization’s network.
An attacker was able to collect network traffic between workstations throughout the network. The analysts
review the following logs:
The Layer 2 address table has hundreds of entries similar to the ones above. Which of the following attacks
has MOST likely occurred?
A.
B.
C.
D.
SQL injection
DNS spoofing
MAC flooding
ARP poisoning
Correct Answer: C
A SOC operator is analyzing a log file that contains the following entries:
Which of the following explains these log entries?
A.
B.
C.
D.
SQL injection and improper input-handling attempts
Cross-site scripting and resource exhaustion attempts
Command injection and directory traversal attempts
Error handling and privilege escalation attempts
Correct Answer: C
QUESTION 153
HOTSPOT
Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with
its remediation.
INSTRUCTIONS
Not all attacks and remediation actions will be used.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Hot Area:
Correct Answer:
QUESTION 154
SIMULATION
A company recently added a DR site and is redesigning the network. Users at the DR site are having issues browsing websites.
INSTRUCTIONS
c:
1. Deny cleartext web traffic.
2. Ensure secure management protocols are used.
3. Resolve issues at the DR site.
The ruleset order cannot be modified due to outside constraints.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Correct Answer: See explanation below.
Firewall 1:
DNS Rule – 10.0.0.1/24 --> ANY --> DNS --> PERMIT
HTTPS Outbound – 10.0.0.1/24 --> ANY --> HTTPS --> PERMIT
Management – ANY --> 10.0.0.1/24 --> SSH --> PERMIT
HTTPS Inbound – ANY --> 10.0.0.1/24 --> HTTPS --> PERMIT
HTTP Inbound – ANY --> 10.0.0.1/24 --> HTTP --> DENY
Firewall 2:
DNS Rule – 10.0.1.1/24 --> ANY --> DNS --> PERMIT
HTTPS Outbound – 10.0.1.1/24 --> ANY --> HTTPS --> PERMIT
Management – ANY --> 10.0.1.1/24 --> SSH --> PERMIT
HTTPS Inbound – ANY --> 10.0.1.1/24 --> HTTPS --> PERMIT
HTTP Inbound – ANY --> 10.0.1.1/24 --> HTTP --> DENY
Firewall 3:
DNS Rule – 10.0.0.1/24 --> 192.168.0.1/24 --> DNS --> PERMIT
HTTPS Outbound – 192.168.0.1/24 --> ANY --> HTTPS --> PERMIT
Management – ANY --> 192.168.0.1/24 --> SSH --> PERMIT
HTTPS Inbound – ANY --> 192.168.0.1/24 --> HTTPS --> PERMIT
HTTP Inbound – ANY --> 192.168.0.1/24 --> HTTP --> DENY
QUESTION 155
SIMULATION
An attack has occurred against a company.
INSTRUCTIONS
You have been tasked to do the following:
Identify the type of attack that is occurring on the network by clicking on the attacker's tablet and reviewing the output.
Identify which compensating controls a developer should implement on the assets, in order to reduce the effectiveness of future
attacks by dragging them to the correct server.
All objects will be used, but not all placeholders may be filled. Objects may only be used once.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Correct Answer:
QUESTION 156
SIMULATION
A systems administrator needs to install a new wireless network for authenticated guest access. The wireless network should
support 802.1X using the most secure encryption and protocol available.
INSTRUCTIONS
Perform the following steps:
1. Configure the RADIUS server.
2. Configure the WiFi controller.
3. Preconfigure the client for an incoming guest. The guest AD credentials are:
User: guest01
Password: guestpass
If at any time you would like to bring back the initial state of the simulation, please click the Reset All Button.
Answer:
See explanation below:
Configure the settings as the following:
QUESTION 157
HOTSPOT
An incident has occurred in the production environment.
INSTRUCTIONS
Analyze the command outputs and identify the type of compromise.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Hot Area:
Correct Answer:
After a recent security incident, a security analyst discovered that unnecessary ports
were open on a firewall policy for a web server. Which of the following firewall
polices would be MOST secure for a web server?
A.
B.
C.
D.
Correct Answer: D
DRAG DROP A security administrator wants to implement strong security on the company smart phones and terminal
servers located in the data center.
INSTRUCTIONS Drag and drop the applicable controls to each asset type.
Controls can be used multiple times and not all placeholders need to be filled.
If at any time you would like to bring back the initial state of the simulation,
please click the Reset All button. Select and Place:
ANSWER:
HOTSPOT W select the Done button to submit.
Hot Area:
Answer:
Explanation:
1: Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization, seeking
unauthorized access to confidential data. As with the e-mail messages used in regular phishing
expeditions, spear phishing messages appear to come from a trusted source. Phishing messages
usually appear to come from a large and well-known company or Web site with a broad membership
base, such as eBay or PayPal. In the case of spear phishing, however, the apparent source of the email is likely to be an individual within the recipient's own company and generally someone in a
position of authority.
2: The Hoax in this question is designed to make people believe that the fake AV (anti- virus)
software is genuine.
3: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private
information that will be used for identity theft. The scammer usually pretends to be a legitimate
business, and fools the victim into thinking he or she will profit.
Braindump2go Guarantee All Exams 100% Pass One Time!
Correct Answer: See explanation below.
QUESTION 2
DRAG DROP
A security engineer is setting up passwordless authentication for the first time. INSTRUCTIONS
Use the minimum set of commands to set this up and verify that it works. Commands cannot be reused.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Select and Place:
Correct Answer: