312-39 Practice Test

Which of the following is a report writing tool that will help incident handlers to generate efficient reports on detected incidents during incident response process?

A.

threat_note

B.

MagicTree

C.

IntelMQ

D.

Malstrom

Ray is a SOC analyst in a company named Queens Tech. One Day, Queens Tech is
affected by a DoS/DDoS attack. For the containment of this incident, Ray and his team are
trying to provide additional bandwidth to the network devices and increasing the capacity of
the servers.
What is Ray and his team doing?

A.

Blocking the Attacks

B.

Diverting the Traffic

C.

Degrading the services

D.

Absorbing the Attack

Sam, a security analyst with INFOSOL INC., while monitoring and analyzing IIS logs,
detected an event matching regex /\\w*((\%27)|(\’))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/ix.
What does this event log indicate?

A.

SQL Injection Attack

B.

Parameter Tampering Attack

C.

XSS Attack

D.

Directory Traversal Attack

Bonney's system has been compromised by a gruesome malware.
What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

A.

Complaint to police in a formal way regarding the incident

B.

Turn off the infected machine

C.

Leave it to the network administrators to handle

D.

Call the legal department in the organization and inform about the incident

Which of the log storage method arranges event logs in the form of a circular buffer?

A.

FIFO

B.

LIFO

C.

non-wrapping

D.

wrapping