Question 1

An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?

Options :

A : Modify the alert rule to ''output alert_syslog: output log''

B : Modify the output module rule to ''output alert_quick: output filename''

C : Modify the alert rule to ''output alert_syslog: output header''

D : Modify the output module rule to ''output alert_fast: output filename''

Answer: A

Question 2

Refer to the exhibit.

What results from this script?

Options :

A : Seeds for existing domains are checked

B : A search is conducted for additional seeds

C : Domains are compared to seed rules

D : A list of domains as seeds is blocked

Answer: B

Question 3

A company's web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities. Which additional element is needed to calculate the risk?

Options :

A : assessment scope

B : event severity and likelihood

C : incident response playbook

D : risk model framework

Answer: D

Question 4

Refer to the exhibit.

An engineer received multiple reports from employees unable to log into systems with the error: The Group Policy Client service failed to logon -- Access is denied. Through further analysis, the engineer discovered several unexpected modifications to system settings. Which type of breach is occurring?

Options :

A : malware break

B : data theft

C : elevation of privileges

D : denial-of-service

Answer: C

Question 5

The incident response team receives information about the abnormal behavior of a host. A malicious file is found being executed from an external USB flash drive. The team collects and documents all the necessary evidence from the computing resource. What is the next step?

Options :

A : Conduct a risk assessment of systems and applications

B : Isolate the infected host from the rest of the subnet

C : Install malware prevention software on the host

D : Analyze network traffic on the host-s subnet

Answer: B

Free 350-201 Mock Exam – Practice Online Confidently

Buying Options: