- All Exams Instant Download
What kind of SIEM deployment architecture the organization is planning to implement?
An organization is implementing and deploying the SIEM with following capabilities. What kind of SIEM deployment architecture the organization is planning to implement?A . Cloud, MSSP ManagedB . Self-hosted, Jointly ManagedC . Self-hosted, Self-ManagedD . Self-hosted, MSSP ManagedView AnswerAnswer: C
Where will you find the reputation IP database, if you want to monitor traffic from known bad IP reputation using OSSIM SIEM?
Where will you find the reputation IP database, if you want to monitor traffic from known bad IP reputation using OSSIM SIEM?A . /etc/ossim/reputationB . /etc/ossim/siem/server/reputation/dataC . /etc/siem/ossim/server/reputation.dataD . /etc/ossim/server/reputation.dataView AnswerAnswer: D
Which of the following command is used to enable logging in iptables?
Which of the following command is used to enable logging in iptables?A . $ iptables -B INPUT -j LOGB . $ iptables -A OUTPUT -j LOGC . $ iptables -A INPUT -j LOGD . $ iptables -B OUTPUT -j LOGView AnswerAnswer: C
What does this event log indicate?
John, a SOC analyst, while monitoring and analyzing Apache web server logs, identified an event log matching Regex /(.|(%|%25)2E)(.|(%|%25)2E)(/|(%|%25)2F|\|(%|%25)5C)/i. What does this event log indicate?A . XSS AttackB . SQL injection AttackC . Directory Traversal AttackD . Parameter Tampering AttackView AnswerAnswer: C
Which of the following tool can be used to filter web requests associated with the SQL Injection attack?
Which of the following tool can be used to filter web requests associated with the SQL Injection attack?A . NmapB . UrlScanC . ZAP proxyD . HydraView AnswerAnswer: B Explanation: Reference: https://aip.scitation.org/doi/pdf/10.1063/1.4982570
Which SIEM deployment architecture will the organization adopt?
An organization wants to implement a SIEM deployment architecture. However, they have the capability to do only log collection and the rest of the SIEM functions must be managed by an MSSP. Which SIEM deployment architecture will the organization adopt?A . Cloud, MSSP ManagedB . Self-hosted, Jointly ManagedC . Self-hosted,...
What is the first step that the IRT will do to the incident escalated by Emmanuel?
Emmanuel is working as a SOC analyst in a company named Tobey Tech. The manager of Tobey Tech recently recruited an Incident Response Team (IRT) for his company. In the process of collaboration with the IRT, Emmanuel just escalated an incident to the IRT. What is the first step that...
Which of the following tool is used to recover from web application incident?
Which of the following tool is used to recover from web application incident?A . CrowdStrike FalconTM OrchestratorB . Symantec Secure Web GatewayC . Smoothwall SWGD . Proxy WorkbenchView AnswerAnswer: A
Which of the log storage method arranges event logs in the form of a circular buffer?
Which of the log storage method arranges event logs in the form of a circular buffer?A . FIFOB . LIFOC . non-wrappingD . wrappingView AnswerAnswer: D Explanation: Reference: https://en.wikipedia.org/wiki/Circular_buffer
What kind of threat intelligence described above?
The threat intelligence, which will help you, understand adversary intent and make informed decision to ensure appropriate security in alignment with risk. What kind of threat intelligence described above?A . Tactical Threat IntelligenceB . Strategic Threat IntelligenceC . Functional Threat IntelligenceD . Operational Threat IntelligenceView AnswerAnswer: B Explanation: Reference: https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/threat-intelligence/what-is-threat-intelligence/
