EC

1. Harley is working as a SOC analyst with PowellTech. Powell Inc is using Internet Information Service (IIS) version 7.0 to host their website. Where will Harley find the web server logs, if he wants to investigate them for any anomalies?. SystemDrive%\inetpub\Logs\fo$files\W3SVCN. SystemDrive%\inetpub\logHles\logs\W35VCN. SystemDrive%\logflles\inetpub\logs\W35VCN. SystemDrive%\Logfiles\iogs\W3SVCN.

2. Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an Incident. to her for further investigation and confirmation. Charline, after a thorough investigation, confirmed the incident and assigned it with an initial priority. What would be her next action according to the SOC workflow?. She should immediately escalate this issue to the management. She should formally raise a ticket and forward it to the IRT. She should communicate this incident to the media immediately. She should immediately contact the network administrator to solve the problem.

3. John a threat analyst at GreenTech-Solutions, wants.to gather information about specific threats against the organization. He started collecting information from various sources, such as humans,.s'oclal media, chat room, and so on, and created a report that contains malicious activity. Which of the following types of threat. intelligence did he use?. Strategic Threat Intelligence. Technical Threat Intelligence. Tactical Threat intelligence. Operational Threat Intelligence.

4. Which of the following stage executed after identifying the required event sources?. Defining Rule for the Use Case. Identifying the monitoring requirements. Implementing and Testing the Use Case. Validating the event source against monitoring requirement.

5. Where w-ill you find the reputation IP database, if you want to monitor traffic from known bad IP reputation using OSSIM SIEM?. /etc/ossim/server/reputation/data. /etc/ossim/server/reputation.data. /etc/ossim/reputation. /etc/siem/ossim/server/reputation.data.

6. Which of the following data source will a SOC Analyst use to monitor connections to the insecure ports?. DNS Data. IIS Data. Netstat Data. DHCP Data.

7. An attacker, in an attempt to exploit the vulnerability in the dynamically generated welcome page, inserted code at the end of the company's URL as follows: http://technosoft.com.com/<scrfpt>alert("WARNING:Thp application has encountered an error" );</script>. Identify the attack demonstrated in the above scenario. SQL Injection Attack. Cross-site Scripting Attack. Session Attack. Denial-of-Service Attack.

8. If the SIEM generates the following four alerts at the same time: I. Firewall block traffic from getting into the network alerts II. SQL Injection attempts alerts III. Data deletion attempts alerts IV. Brute force attempt alerts Which alert should be given least priority as over effective alert triaging?. II. III. I. IV.

9. Wesley is an Incident handler in a company named Maddison Tech. one day, he was learning techniques for eradicating the insecure deserialization attacks, what among the following should Wesley avoid from considering?. Validate untrusted input, which is to be serialized to ensure that serialized data contain only trusted classes. Deserialization of trusted data must cross a trust boundary. Allow serialization for security-sensitive classes. Understand the security permissions given to serialization and deserialization.

10. Which encoding replaces unusual ASCII characters with "%" followed by the character's two-digit ASCII code expressed in hexadecimal ?. UTF Encoding. Base64 Encoding. Unicode Encoding. URL Encoding.

11. Chloe, a SOC analyst with Jake Tech, is checking Linux system logs. She is investigating files at/var/log/wtr What Chloe is looking at?. General message and system-related stuff. Error log. System boot log. Login records.

12. Which of the following contains the performance measure, and proper project and time management details ?. Incident Response Tactics. Incident Response Policy. Incident Response Procedures. Incident Response Process.

13. Which attack works like a dictionary attack, but adds some numbers and symbols te the words from the dictionary and tries to crack the password?. Hybrid Attack. Birthday Attack. Brute force Attack. Rainbow Table Attack.

14. Jason, a SOC Analyst with Maximus Tech, was investigating Cisco ASA Firewall logs and came across the following log entry: May 06 2018 2J:27:27 asa 1: %ASA -S —11008: User's enable_15' excuted the 'configure term' command What does the security level in the above log indicates?. Warning condition message. Informational message. Critical condition message. Normal but significant message.

15. Which of the following command is used to enable logging in iptabtes?. $ iptables -B INPUT-J LOG. $ iptables -A INPUT -j LOG. $ iptables -B OUTPUT LOG. $ iptables -A OUTPUT-j LOG.