NEW QUESTION NO: 40
An organization needs to determine of any systems on its network (10.0.25.0/24) have web services running on port 80 or 443. Which of the following is the BEST command to do this?
A. netstat -p 80-443 10.0.25.0/24
B. nmap -v 80,443 10.0.25.0/24
C. netstat -v 80,443 10.0.25.0/24
D. nmap -p 80,443 10.0.25.0/24
Answer: C
Explanation/Reference:
Explanation:

NEW QUESTION NO: 41
A forensics investigator has been assigned the task of investigating a system user for suspicion of using a company-owned workstation to view unauthorized content. Which of the following would be a proper course of action for the investigator to take?
A. Notify the user that their workstation is being confiscated to perform an investigation, providing no details as to the reasoning.
B. Confiscate the workstation while the suspected employee is out of the office, andperform a search on the asset.
C. Confiscate the workstation while the suspected employee is out of the office, and perform the search on bit-for-bit image of the hard drive.
D. Notify the user that the workstation is being confiscated to perform an investigation, providing complete transparency as to the suspicions.
Answer: B
Explanation/Reference:
Explanation:

NEW QUESTION NO: 42
Which of the following are legally compliant forensics applications that will detect ADS or a file with an incorrect file extension? (Choose two.)
A. Regedit
B. EnCase
C. dd
D. FTK
E. Procmon
Answer: A,C
Explanation/Reference:
Reference:http://www.osforensics.com/find-misnamed-files.html
http://www.osforensics.com/identify.html

NEW QUESTION NO: 43
An attacker has exfiltrated the SAM file from a Windows workstation. Which of the following attacks is MOST likely being perpetrated?
A. user enumeration
B. Brute forcing
C. Password sniffing
D. Hijacking/rooting
Answer: C
Explanation/Reference:
Reference:http://hackersonlineclub.com/to-hack-window-passwords/

NEW QUESTION NO: 44
A system administrator is informed that a user received an email containing a suspicious attachment.
Which of the following methods is the FASTEST way to determine whether the file is suspicious or not?
A. Reverse engineering
B. Virus scanning
C. Virtualization
D. Sandboxing
Answer: D
Explanation/Reference:
Explanation:

NEW QUESTION NO: 45
A network engineer has collected a packet capture using Wireshark and given it to the team for analysis.
The team is looking for activity based on the internal IP address of 10.0.25.123. Which of the following filters should the team use to look at only traffic for this IP?
A. source.ip == 10.0.25.123 && destination.ip == 10.0.25.123
B. source tcp = 10.0.25.123 and destination tcp = 10.0.25.123
C. src.ip == 10.0.25.123 or dst.ip == 10.0.25.123
D. src.ip = 10.0.25.123 or dst.ip = 10.0.25.123
Answer: D
Explanation/Reference:
Explanation:

NEW QUESTION NO: 46
Which of the following are reasons that a hacker would execute a DoS or a DDoS attack? (Choose two.)
A. To determine network bandwidth
B. To distract the incident response team
C. To distract the remediation team
D. To promote business operations
E. To compromise a system and reuse the IP address
Answer: A,B
Explanation/Reference:
Reference:https://en.wikipedia.org/wiki/Denial-of-service_attack

NEW QUESTION NO: 47
An incident responder suspects that a host behind a firewall is infected with malware. Which of the following should the responder use to find the IP address of the infected machine?
A. NAT table
B. ARP cache
C. DNS cache
D. CAM cable
Answer: C
Explanation/Reference:
Explanation:

NEW QUESTION NO: 48
A forensics analyst is analyzing an executable and thinks it may have some text of interest hidden within it.
Which of the following tools can the analyst use to assist in validating the suspicion?
A. Isof
B. cat command
C. hex editor
D. more
Answer: C
Explanation/Reference:
Reference:https://en.wikipedia.org/wiki/Hex_editor

NEW QUESTION NO: 49
During a network-based attack, which of the following data sources will provide the BEST data to quickly determine the attacker's point of origin? (Choose two.)
A. DNS logs
B. System logs
C. WIPS logs
D. Firewall logs
E. IDS/IPS logs
Answer: A,D
Explanation/Reference:
Explanation:

NEW QUESTION NO: 50
A security analyst discovers a zero-day vulnerability affecting Windows, which has not been publicly identified. The security analyst assumes this vulnerability is present on millions of computer system and feels an obligation to share this information with other security professionals. Which of the following would be the MOST adverse consequences of the analyst sharing this information?
A. Public exposure of the vulnerability, including to potential attackers
B. Unexpected media coverage of the discovery
C. Potential distribution of misinformation
D. Possible legal consequences for the analyst
Answer: A
Explanation/Reference:
Explanation: