Q107. Refer to the exhibit.

Which application protocol is in this PCAP file?

Q108. Refer to the exhibit.

What is depicted in the exhibit?

Q109. What is the impact of false positive alerts on business compared to true positive?

Q110. While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header.
Which technology makes this behavior possible?

Q111. A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver. Which event category is described?

Q112. What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

Q113. Refer to the exhibit.

An engineer is analyzing a PCAP file after a recent breach An engineer identified that the attacker used an aggressive ARP scan to scan the hosts and found web and SSH servers. Further analysis showed several SSH Server Banner and Key Exchange Initiations. The engineer cannot see the exact data being transmitted over an encrypted channel and cannot identify how the attacker gained access How did the attacker gain access?

Q114. Refer to the exhibit.

Which stakeholders must be involved when a company workstation is compromised?

Q115.

Refer to the exhibit. This request was sent to a web application server driven by a database.
Which type of web server attack is represented?

Q116. A system administrator is ensuring that specific registry information is accurate.
Which type of configuration information does the HKEY_LOCAL_MACHINE hive contain?

Q117. What is an attack surface as compared to a vulnerability?

Q118. Refer to the exhibit.

What information is depicted?

Q119. A user received a malicious attachment but did not run it. Which category classifies the intrusion?

Q120. Which event is a vishing attack?

Q121. One of the objectives of information security is to protect the CIA of information and systems.
What does CIA mean in this context?

Q122. Which incidence response step includes identifying all hosts affected by an attack?

Q123. An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, “File: Clean.” Which regex must the analyst import?

Q124. Drag and drop the security concept on the left onto the example of that concept on the right.

Q125. An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.

Which obfuscation technique is the attacker using?

Q126. When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?