Question 1

An analyst is configuring a security information and event management system to capture filelessmalware execution events.Which of the following log files requires additional configuration to accomplish this task?

Options :

A : Microsoft-Windows-Crypto-DPAPI/Operational

B : Microsoft-Windows-PowerShell/Operational

C : Microsoft-Windows-UserPnp/DeviceInstall

D : Microsoft-Windows-TerminalServices-LocalSessionManager/Operational

Answer: B

Question 2

Which of the following is the most important component to include in the preparation phase of anincident response plan?

Options :

A : Roles and responsibilities

B : After action reports

C : Data integrity validation

D : Chain of custody

Answer: A

Question 3

Which of the following is the best reason to heavily segment business-critical assets from within the network?

Options :

A : Legacy systems

B : Degraded functionality

C : Asset obfuscation

D : Proprietary server

Answer: A

Question 4

Which of the following should a cybersecurity analyst utilize when a notification is inaccurate?

Options :

A : Data enrichment

B : Dashboard creation

C : Threat hunting

D : Alert tuning

Answer: D

Question 5

A cybersecurity analyst is reviewing static application security testing scan results and notices afinding for hard-coded credentials.Which of the following should the analyst recommend to the application team to resolve thisconcern?

Options :

A : Implement a privileged access management solution.

B : Enable single sign-on.

C : Obfuscate application programming interface keys.

D : Integrate secrets management.

Answer: D

Free 1Z0-2000 Mock Exam – Practice Online Confidently

Buying Options: