QUESTION 36
Which of the following methods are used by attackers to find new ransomware victims? (Choose two.)

QUESTION 37
Which of the following does the command nmap -open 10.10.10.3 do?

QUESTION 38
A security professional discovers a new ransomware strain that disables antivirus on the endpoint during an infection. Which location would be the BEST place for the security professional to find technical information about this malware?

QUESTION 39
Malicious code designed to execute in concurrence with a particular event is BEST defined as which of the following?

QUESTION 40
A Linux administrator is trying to determine the character count on many log files. Which of the following command and flag combinations should the administrator use?

QUESTION 41
An administrator investigating intermittent network communication problems has identified an excessive amount of traffic from an external-facing host to an unknown location on the Internet. Which of the following BEST describes what is occurring?

QUESTION 42
A security operations center (SOC) analyst observed an unusually high number of login failures on a particular database server. The analyst wants to gather supporting evidence before escalating the observation to management. Which of the following expressions will provide login failure data for 11/24/2015?

QUESTION 43
A security investigator has detected an unauthorized insider reviewing files containing company secrets.
Which of the following commands could the investigator use to determine which files have been opened by this user?

QUESTION 44
Which of the following is the GREATEST risk of having security information and event management (SIEM) collect computer names with older log entries?

QUESTION 45
If a hacker is attempting to alter or delete system audit logs, in which of the following attack phases is the hacker involved?

QUESTION 46
Nmap is a tool most commonly used to:

QUESTION 47
An organization recently suffered a breach due to a human resources administrator emailing employee names and Social Security numbers to a distribution list. Which of the following tools would help mitigate this risk from recurring?

QUESTION 48
After successfully enumerating the target, the hacker determines that the victim is using a firewall. Which of the following techniques would allow the hacker to bypass the intrusion prevention system (IPS)?

QUESTION 49
Which asset would be the MOST desirable for a financially motivated attacker to obtain from a health insurance company?

QUESTION 50
Which of the following is susceptible to a cache poisoning attack?

QUESTION 51
Which of the following would MOST likely make a Windows workstation on a corporate network vulnerable to remote exploitation?

QUESTION 52
Which of the following is a cybersecurity solution for insider threats to strengthen information protection?

QUESTION 53
An organization recently suffered a data breach involving a server that had Transmission Control Protocol (TCP) port 1433 inadvertently exposed to the Internet. Which of the following services was vulnerable?

QUESTION 54
A Windows system administrator has received notification from a security analyst regarding new malware that executes under the process name of “armageddon.exe” along with a request to audit all department workstations for its presence. In the absence of GUI-based tools, what command could the administrator execute to complete this task?