QUESTION: 145

In a cloud environment, the provider offers relief to an organization's teams by sharing in many of the operational duties. In a shared responsibility model, which of the following responsibilities belongs to the provider in a PaaS implementation?

Application-specific data assets
Application user access management
Application-specific logic and code
Application/platform software

Answer(s): D

Reveal Solution Next Question

QUESTION: 146

SIMULATION
You are about to enter the virtual environment.
Once you have completed the item in the virtual environment, you will NOT be allowed to return to this item.
Click Next to continue.
Question and Instructions
DO NOT perform the following actions within the virtual environment. Making any of these changes will cause the virtual environment to fail and prevent proper scoring.
1. Disabling ssh
2. Disabling systemd
3. Altering the network adapter 172.162.0.0
4. Changing the password in the lab admin account
Once you have completed the item in the virtual environment. you will NOT be allowed to return to this item.
TEST QUESTION
This system was recently patched following the exploitation of a vulnerability by an attacker to enable data exfiltration.
Despite the vulnerability being patched, it is likely that a malicious TCP service is still running and the adversary has achieved persistence by creating a systemd service.
Examples of commands to use:
kill, killall lsof man, --help (use for assistance)
netstat (useful flags: a, n, g, u)
ps (useful flag: a)
systemctl (to control systemd)
Please Note: the list of commands shown above is not exhaustive. All native commands are available.
INSTRUSTIONS
Using the following credentials:
Username: labXXXadmin
Password: XXXyyYzz!
Investigate to identify indicators of compromise and then remediate them. You will need to make at least two changes:
1. End the compromised process that is using a malicious TCP service.
2. Remove the malicious persistence agent by disabling the service's ability to start on boot.

See Explanation section for answer.

Answer(s): A

Explanation:

Find the malicious service and use ג€Killallג€ switch command to end the process.

Reveal Solution Next Question

QUESTION: 147

An analyst received a list of IOCs from a government agency. The attack has the following characteristics:
1. The attack starts with bulk phishing.
2. If a user clicks on the link, a dropper is downloaded to the computer.
3. Each of the malware samples has unique hashes tied to the user.
The analyst needs to identify whether existing endpoint controls are effective.
Which of the following risk mitigation techniques should the analyst use?

Update the incident response plan.
Blocklist the executable.
Deploy a honeypot onto the laptops.
Detonate in a sandbox.

Answer(s): D

Reveal Solution Next Question

QUESTION: 148

An organization's finance system was recently attacked. A forensic analyst is reviewing the contents of the compromised files for credit card data.
Which of the following commands should the analyst run to BEST determine whether financial data was lost?

grep ג€"v '^4 [0ג€"9] {12} (?:[0ג€"9]{3}) ?$' file
grep '^4 [0ג€"9]{12}(?:[0ג€"9]{3})?$' file
grep '^6(?:011|5[0ג€"9]{2}) [0ג€"9] {12} ?' file
grep ג€"v '^6(?:011|5[0ג€"9]{2})[0ג€"9]{12}?' file

Answer(s): B

Reveal Solution Next Question

Free CAS-004 Exam Braindumps (page: 37)

QUESTION: 145

QUESTION: 146

Explanation:

QUESTION: 147

QUESTION: 148