SYO-501 무료 덤프문제 온라인 액세스

During a routine check, a security analyst discovered the script responsible for the backup of the corporate file server has been changed to the following:

Which of the following BEST describes the type of malware the analyst discovered?

• A.Logic bomb
• B.Rootkit
• C.Keylogger
• D.RAT

After reading a security bulletin, a network security manager Is concerned that a malicious actor may have breached the network using the same software flaw. The exploit code Is publicly available and has been reported as being used against other industries in the same vertical. Which of the following should the network security manager consult fiRST to determine a priority list for forensic review?

• A.The SIEM alerts
• B.The IDS logs
• C.The full packet capture data
• D.The vulnerability scan output

A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them.

정답:

When dealing with multiple issues, address them in order of volatility (OOV); always deal with the most volatile first. Volatility can be thought of as the amount of time that you have to collect certain data before a window of opportunity is gone. Naturally, in an investigation you want to collect everything, but some data will exist longer than others, and you cannot possibly collect all of it once. As an example, the OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and printouts.
Order of volatility: Capture system images as a snapshot of what exists, look at network traffic and logs, capture any relevant video/screenshots/hashes, record time offset on the systems, talk to witnesses, and track total man-hours and expenses associated with the investigation.

A company has a team of penetration testers. This team has located a file on the company file server that they believe contains cleartext usernames followed by a hash. Which of the following tools should the penetration testers use to learn more about the content of this file?

• A.Netcat
• B.Password cracker
• C.Exploitation framework
• D.Vulnerability scanner

A systems administrator performing routine maintenance notices a user's profile is sending GET requests to an external IP address Which of the following BEST fits this IOC?

• A.Logic bomb
• B.Key logger
• C.Trojan
• D.Bots