Crack4sure Logo
3 Months Free Update
3 Months Free Update
3 Months Free Update
Which of the following digital forensic goals is being provided with hashing and time-stamping of the electronic evidence?
Which two options represent the most basic methods for designing a DMZ network firewall? (Choose two.)
During an audit, an organization's ability to establish key performance indicators for its service hosting solution is discovered to be weak. What could be the cause of this?
When tracing an attack to the point of origin, which of the following items is critical data to map layer 2 switching?
Which two answer options are the BEST reasons to conduct post-incident reviews after an incident occurs in an organization? (Choose two.)
A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank’s website and asks them to log in with their username and password. Which type of attack is this?
During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?
Which of the following is an essential component of a disaster recovery plan?
Which of the following, when exposed together, constitutes PII? (Choose two.)
A Linux administrator is trying to determine the character count on many log files. Which of the following command and flag combinations should the administrator use?
An organization was recently hit with a ransomware attack that encrypted critical documents and files that were stored on the corporate file server.
Which of the following provides the organization with the BEST chance for recovering their data?
Which term describes the process of collecting logs from many sources across an IT infrastructure into a single, centralized platform to be reviewed and analyzed?
A security administrator notices a process running on their local workstation called SvrsScEsdKexzCv.exe.
The unknown process is MOST likely:
The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)
A digital forensics investigation requires analysis of a compromised system's physical memory. Which of the following tools should the forensics analyst use to complete this task?
According to company policy, all accounts with administrator privileges should have suffix _ja. While reviewing Windows workstation configurations, a security administrator discovers an account without the suffix in the administrator’s group. Which of the following actions should the security administrator take?
Which two mitigation strategies can prevent an attack delivered via malware? (Choose two.)
Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are
MOST important for log integrity? (Choose two.)
Which of the following attack vectors capitalizes on a previously undisclosed issue with a software application?
A security operations center (SOC) analyst observed an unusually high number of login failures on a particular database server. The analyst wants to gather supporting evidence before escalating the observation to management. Which of the following expressions will provide login failure data for 11/24/2015?
Which common source of vulnerability should be addressed to BEST mitigate against URL redirection attacks?
An incident response team is concerned with verifying the integrity of security information and event
management (SIEM) events after being written to disk. Which of the following represents the BEST option for addressing this concern?
Which answer option is a tactic of social engineering in which an attacker engages in an attack performed by phone?
An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After
reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?
In a Linux operating system, what kind of information does a /var/log/daemon.log file contain?
Which of the following could be useful to an organization that wants to test its incident response procedures without risking any system downtime?
Which of the following are legally compliant forensics applications that will detect an alternative data stream (ADS) or a file with an incorrect file extension? (Choose two.)
A system administrator identifies unusual network traffic from outside the local network. Which of the following
is the BEST method for mitigating the threat?
Malicious code designed to execute in concurrence with a particular event is BEST defined as which of the following?
During the forensic analysis of a compromised computer image, the investigator found that critical files are missing, caches have been cleared, and the history and event log files are empty. According to this scenario, which of the following techniques is the suspect using?
An incident responder has collected network capture logs in a text file, separated by five or more data fields.
Which of the following is the BEST command to use if the responder would like to print the file (to terminal/ screen) in numerical order?
During which of the following attack phases might a request sent to port 1433 over a whole company network be seen within a log?
Which of the following describes United States federal government cybersecurity policies and guidelines?
ABC Company uses technical compliance tests to verify that its IT systems are configured according to organizational information security policies, standards, and guidelines. Which two tools and controls can ABC Company use to verify that its IT systems are configured accordingly? (Choose two.)
Which of the following types of digital evidence is considered the MOST volatile?
An unauthorized network scan may be detected by parsing network sniffer data for:
Organizations considered “covered entities” are required to adhere to which compliance requirement?
An attacker intercepts a hash and compares it to pre-computed hashes to crack a password. Which of the following methods has been used?
Detailed step-by-step instructions to follow during a security incident are considered:
Which asset would be the MOST desirable for a financially motivated attacker to obtain from a health insurance company?
During a security investigation, a suspicious Linux laptop is found in the server room. The laptop is processing information and indicating network activity. The investigator is preparing to launch an investigation to
determine what is happening with this laptop. Which of the following is the MOST appropriate set of Linux commands that should be executed to conduct the investigation?
Which of the following tools can be used as an intrusion detection system (IDS)? (Choose three.)
Which three tools are used for integrity verification of files? (Choose three.)
A security engineer is setting up security information and event management (SIEM). Which of the following log sources should the engineer include that will contain indicators of a possible web server compromise? (Choose two.)
An incident responder was asked to analyze malicious traffic. Which of the following tools would be BEST for this?
TESTED 17 Jun 2025