問題1
What is the most recent NIST standard for incident response?
What is the most recent NIST standard for incident response?
正確答案: C
說明：（僅 NewDumps 成員可見）
問題2
In which of the following types of fuzz testing strategies the new data will be generated from scratch and the amount of data to be generated are predefined based on the testing model?
In which of the following types of fuzz testing strategies the new data will be generated from scratch and the amount of data to be generated are predefined based on the testing model?
正確答案: C
說明：（僅 NewDumps 成員可見）
問題3
BadGuy Bob hid files in the slack space, changed the file headers, hid suspicious files in executables, and changed the metadata for all types of files on his hacker laptop. What has he committed?
BadGuy Bob hid files in the slack space, changed the file headers, hid suspicious files in executables, and changed the metadata for all types of files on his hacker laptop. What has he committed?
正確答案: C
說明：（僅 NewDumps 成員可見）
問題4
MegaHealth, a global healthcare provider, experienced a sudden malfunction in its MRI machines.
Investigations revealed malware that tweaked MRI results, potentially skewing diagnosis outcomes. This malware not only resided in the MRI machines but also communicated with an external command-and-control (C & C) server, sending partial patient data. With tools like an advanced endpoint protection system and a network monitor, what should be the first step?
MegaHealth, a global healthcare provider, experienced a sudden malfunction in its MRI machines.
Investigations revealed malware that tweaked MRI results, potentially skewing diagnosis outcomes. This malware not only resided in the MRI machines but also communicated with an external command-and-control (C & C) server, sending partial patient data. With tools like an advanced endpoint protection system and a network monitor, what should be the first step?
正確答案: B
說明：（僅 NewDumps 成員可見）
問題5
Logan, a network security analyst, notices a pattern of repeated ICMP echo requests being sent to a broad range of IP addresses within the company ' s internal subnet. To confirm his suspicion of a possible reconnaissance attempt, he opens Wireshark and starts analyzing the traffic for unusual scanning behavior.
What technique is most likely being used by the attacker?
Logan, a network security analyst, notices a pattern of repeated ICMP echo requests being sent to a broad range of IP addresses within the company ' s internal subnet. To confirm his suspicion of a possible reconnaissance attempt, he opens Wireshark and starts analyzing the traffic for unusual scanning behavior.
What technique is most likely being used by the attacker?
正確答案: A
說明：（僅 NewDumps 成員可見）
問題6
Which of the following tools helps incident handlers to view the file system, retrieve deleted data, perform timeline analysis, web artifacts, etc., during an incident response process?
Which of the following tools helps incident handlers to view the file system, retrieve deleted data, perform timeline analysis, web artifacts, etc., during an incident response process?
正確答案: C
說明：（僅 NewDumps 成員可見）
問題7
Joseph is an incident handling and response (IH & R) team lead in Toro Network Solutions Company. As a part of IH & R process, Joseph alerted the service providers, developers, and manufacturers about the affected resources.
Identify the stage of IH & R process Joseph is currently in.
Joseph is an incident handling and response (IH & R) team lead in Toro Network Solutions Company. As a part of IH & R process, Joseph alerted the service providers, developers, and manufacturers about the affected resources.
Identify the stage of IH & R process Joseph is currently in.
正確答案: B
說明：（僅 NewDumps 成員可見）
問題8
Rica works as an incident handler for an international company. As part of her role, she must review the present security policy implemented. Upon inspection, Rica finds that the policy is wide open, and only known dangerous services/attacks or behaviors are blocked. Which of the following is the current policy that Rica identified?
Rica works as an incident handler for an international company. As part of her role, she must review the present security policy implemented. Upon inspection, Rica finds that the policy is wide open, and only known dangerous services/attacks or behaviors are blocked. Which of the following is the current policy that Rica identified?
正確答案: D
說明：（僅 NewDumps 成員可見）
問題9
Which stage of the incident response and handling process involves auditing the system and network log files?
Which stage of the incident response and handling process involves auditing the system and network log files?
正確答案: D
說明：（僅 NewDumps 成員可見）
問題10
A malicious, security-breaking program is disguised as a useful program. Such executable programs, which are installed when a file is opened, allow others to control a user ' s system. What is this type of program called?
A malicious, security-breaking program is disguised as a useful program. Such executable programs, which are installed when a file is opened, allow others to control a user ' s system. What is this type of program called?
正確答案: C
說明：（僅 NewDumps 成員可見）
問題11
A large insurance enterprise recently completed an internal phishing simu-lation to evaluate its incident reporting workflow. Upon reviewing the ticketing system logs, the IR lead discovered that several phishing- related reports submitted by employees had been mistakenly logged as routine IT service requests. This misrouting prevented timely review by the IH & R team, delaying appropriate follow-up actions.
The root cause was traced to frontline support staff misinterpreting subtle incident indicators as generic technical issues. Recognizing the potential risk this poses to early issue detection, the Chief Information Security Officer directed an overhaul of the alert-handling procedures. This included refining the reporting workflow, embedding clearer triage rules within the ticketing platform, and initiating refresher training to strengthen tier-one decision-making when handling ambiguous user reports. Which IR concern is being addressed through this corrective action?
A large insurance enterprise recently completed an internal phishing simu-lation to evaluate its incident reporting workflow. Upon reviewing the ticketing system logs, the IR lead discovered that several phishing- related reports submitted by employees had been mistakenly logged as routine IT service requests. This misrouting prevented timely review by the IH & R team, delaying appropriate follow-up actions.
The root cause was traced to frontline support staff misinterpreting subtle incident indicators as generic technical issues. Recognizing the potential risk this poses to early issue detection, the Chief Information Security Officer directed an overhaul of the alert-handling procedures. This included refining the reporting workflow, embedding clearer triage rules within the ticketing platform, and initiating refresher training to strengthen tier-one decision-making when handling ambiguous user reports. Which IR concern is being addressed through this corrective action?
正確答案: A,B,C,D,E