A security consultant is analyzing data from a recent compromise. The following data points are documented Access to data on share drives and certain networked hosts was lost after an employee logged in to an interactive session as a privileged user.
The data was unreadable by any known commercial software.
The issue spread through the enterprise via SMB only when certain users accessed data.
Removal instructions were not available from any major antivirus vendor.
Which of the following types of malware is this example of'?

• A. Worm
• B. Keylogger
• C. Ransomware
• D. RAT
• E. Backdoor

A user contacts the help desk about getting a newly installed application to work When searching the logging servers for the user's IP address the help desk analyst finds the following output from the host-based firewall:

Which of the following is MOST likely occurring?

• A. The host cc abc com is scanning the PC
• B. The application needs host firewall rules
• C. WINDOWS-ABCXYZ is an unknown host
• D. The PC is infected with C2

A security administrator is working with the human resources department to classify data held by the company. The administrator has determined the data contains a variety of data types, including health information, employee names and addresses, trade secrets, and confidential customer information. Which of the following should the security administrator do NEXT?

• A. Label sensitive data according to age to comply with retention policies.
• B. Apply a predefined set of labels from government sources to all data within the company.
• C. Create a custom set of data labels to group the data by sensitivity and protection requirements.
• D. Destroy company information that is not labeled in compliance with government regulations and laws.

A computer forensics team is performing an integrity check on key systems files. The team is comparing the signatures of original baseline files with the latest signatures. The original baseline was taken on March 2, 2016. and was established to be clean of malware and uncorrupted. The latest tile signatures were generated yesterday. One file is known to be corrupted, but when the team compares the signatures of the original and latest flies, the team sees the Following:
Original: 2d da b1 4a fc f1 98 06 b1 e5 26 b2 df e5 5b 3e cb 83 e1
Latest: 2d da b1 4a 98 fc f1 98 bl e5 26 b2 df e5 5b 3e cb 83 e1
Which of the following is MOST likely the situation?

• A. The original baseline was compromised, so the corrupted file was always on the system.
• B. The signature comparison is using two different algorithms that happen to have generated the same values.
• C. The forensics team must have reverted the system to the original date. Which resulted in an identical hash calculation?
• D. The algorithm used to calculate the hash has a collision weakness, and an attacker has exploited it.

A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers, the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?

• A. Physical
• B. Detective
• C. Preventive
• D. Compensating

설명: (Fast2test 회원만 볼 수 있음)