Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an incident to her for
further investigation and confirmation. Charline, after a thorough investigation, confirmed the
incident and assigned it with an initial priority.
What would be her next action according to the SOC workflow?
B
Which of the following tool can be used to filter web requests associated with the SQL Injection
attack?
B
Reference:
https://aip.scitation.org/doi/pdf/10.1063/1.4982570
Which of the following process refers to the discarding of the packets at the routing level without
informing the source that the data did not reach its intended recipient?
C
Reference:
https://en.wikipedia.org/wiki/Black_hole_(networking)#:~:text=In%20networking%2C%20black%
20holes%20refer,not%20reach%20its%20intended%20recipient.
John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to
prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is
coming.
Which of the following data source will he use to prepare the dashboard?
D
Which of the following contains the performance measures, and proper project and time
management details?
D
Which
of the following technique protects from flooding attacks originated from the valid prefixes (IP
addresses) so that they can be traced to its true source?
C
Reference:
http://www.mecs-press.org/ijcnis/ijcnis-v5-n5/IJCNIS-V5-N5-6.pdf
(3)
Which of the following data source will a SOC Analyst use to monitor connections to the insecure
ports?
A
Which
of the following steps of incident handling and response process focus on limiting the scope and
extent of an incident?
A
Which of the following stage executed after identifying the required event sources?
D
Which of the following attack can be eradicated by disabling of "allow_url_fopen and
allow_url_include" in the php.ini file?
B
In which log collection mechanism, the system or application sends log records either on the local
disk or over the network.
A
Identify the attack in which the attacker exploits a target system through publicly known but still
unpatched vulnerabilities.
C
Reference:
https://www.bullguard.com/bullguard-security-center/pc-security/computer-
threats/what-are-zero
- day-attacks.aspx
Peter, a SOC analyst with Spade Systems, is monitoring and analyzing the router logs of the company
and wanted to check the logs that are generated by access control list numbered 210.
What filter should Peter add to the 'show logging' command to get the required output?
C
Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.
What does this event log indicate?
D
Reference:
https://infosecwriteups.com/what-is-parameter-tampering-5b1beb12c5ba
Which of the following is a correct flow of the stages in an incident handling and response (IH&R)
process?
B
Reference:
https://blog.elearnsecurity.com/the-4-steps-of-incident-handling-response.html