The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?

1. A. Contain the malware
2. B. Install IPS software
3. C. Determine the escalation path
4. D. Perform vulnerability assessment

Correct Answer: D

Refer to the exhibit.

Which indicator of compromise is represented by this STIX?

1. A. website redirecting traffic to ransomware server
2. B. website hosting malware to download files
3. C. web server vulnerability exploited by malware
4. D. cross-site scripting vulnerability to backdoor server

Correct Answer: C

Refer to the exhibit.

An engineer must tune the Cisco IOS device to mitigate an attack that is broadcasting a large number of ICMP packets. The attack is sending the victim’s spoofed source IP to a network using an IP broadcast address that causes devices in the network to respond back to the source IP address. Which action does the engineer recommend?

1. A. Use command ip verify reverse-path interface
2. B. Use global configuration command service tcp-keepalives-out
3. C. Use subinterface command no ip directed-broadcast
4. D. Use logging trap 6

Correct Answer: A

The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?

1. A. Determine the assets to which the attacker has access
2. B. Identify assets the attacker handled or acquired
3. C. Change access controls to high risk assets in the enterprise
4. D. Identify movement of the attacker in the enterprise

Correct Answer: D

A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?

1. A. Assess the network for unexpected behavior
2. B. Isolate critical hosts from the network
3. C. Patch detected vulnerabilities from critical hosts
4. D. Perform analysis based on the established risk factors

Correct Answer: B