During an incident, the following actions have been taken:
-Executing the malware in a sandbox environment
-Reverse engineering the malware
-Conducting a behavior analysis
Based on the steps presented, which of the following incident handling processes has been taken?
Correct Answer:
A
The “Containment, eradication and recovery” phase is the period in which incident response team tries to contain the incident and, if necessary, recover from it (restore any affected resources, data and/or processes).
Which of the following are common areas of vulnerabilities in a network switch? (Choose two.)
Correct Answer:
AB
During a log review, an incident responder is attempting to process the proxy server’s log files but finds that they are too large to be opened by any file viewer. Which of the following is the MOST appropriate technique to open and analyze these log files?
Correct Answer:
A
Malicious code designed to execute in concurrence with a particular event is BEST defined as which of the following?
Correct Answer:
A
When attempting to determine which system or user is generating excessive web traffic, analysis of which of the following would provide the BEST results?
Correct Answer:
D