Question 1

A security analyst has found the following suspicious DNS traffic while analyzing a packet capture:

• DNS traffic while a tunneling session is active.

• The mean time between queries is less than one second.

• The average query length exceeds 100 characters.

Which of the following attacks most likely occurred?

Options :

A : DNS exfiltration

B : DNS spoofing

C : DNS zone transfer

D : DNS poisoning

Answer: A

Question 2

While configuring a SIEM for an organization, a security analyst is having difficulty correlating incidents across different systems. Which of the following should be checked first?

Options :

A : If appropriate logging levels are set

B : NTP configuration on each system

C : Behavioral correlation settings

D : Data normalization rules

Answer: B

Question 3

Which of the following explains the importance of a timeline when providing an incident response report?

Options :

A :

The timeline contains a real-time record of an incident and provides information that helps to simplify a postmortem analysis.

B :

An incident timeline provides the necessary information to understand the actions taken to mitigate the threat or risk.

C :

The timeline provides all the information, in the form of a timetable, of the whole incident response process including actions taken.

D :

An incident timeline presents the list of commands executed by an attacker when the system was compromised, in the form of a timetable.

Answer: C

Question 4

An incident response analyst is investigating the root cause of a recent malware outbreak. Initial binary analysis indicates that this malware disables host security services and performs cleanup routines on it infected hosts, including deletion of initial dropper and removal of event log entries and prefetch files from the host. Which of the following data sources would most likely reveal evidence of the root cause? (Select two).

Options :

A : Creation time of dropper

B : Registry artifacts

C : EDR data

D : Prefetch files

E : File system metadata

F : Sysmon event log

Answer: B,C

Question 5

During an incident involving phishing, a security analyst needs to find the source of the malicious email. Which of the following techniques would provide the analyst with this information?

Options :

A : Header analysis

B : Packet capture

C : SSL inspection

D : Reverse engineering

Answer: A

Free CS0-003 Mock Exam – Practice Online Confidently

Buying Options: