QUESTION: 85

Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

A policy violation is active for host 10.10.101.24.
A host on the network is sending a DDoS attack to another inside host.
There are two active data exfiltration alerts.
A policy violation is active for host 10.201.3.149.

Answer(s): C

Reveal Solution Next Question

QUESTION: 86

Which security technology allows only a set of pre-approved applications to run on a system?

application-level blacklisting
host-based IPS
application-level whitelisting
antivirus

Answer(s): C

Reveal Solution Next Question

QUESTION: 87

An investigator is examining a copy of an ISO file that is stored in CDFS format.
What type of evidence is this file?

data from a CD copied using Mac-based system
data from a CD copied using Linux system
data from a DVD copied using Windows system
data from a CD copied using Windows

Answer(s): B

Explanation:

CDfs is a virtual file system for Unix-like operating systems; it provides access to data and audio tracks on Compact Discs.
When the CDfs driver mounts a Compact Disc, it represents each track as a file. This is consistent with the Unix convention "everything is a file".

Reference:

https://en.wikipedia.org/wiki/CDfs

Reveal Solution Next Question

QUESTION: 88

Which piece of information is needed for attribution in an investigation?

proxy logs showing the source RFC 1918 IP addresses
RDP allowed from the Internet
known threat actor behavior
802.1x RADIUS authentication pass arid fail logs

Answer(s): C

Explanation:

Actually this is the most important thing: know who, what, how, why, etc.. attack the network.

Reveal Solution Next Question

Free 200-201 Exam Braindumps (page: 22)

QUESTION: 85

QUESTION: 86

QUESTION: 87

Explanation:

Reference:

QUESTION: 88

Explanation: