INTERMEDIATE QUIZ | CySA+ CS0-002 Domain 4: Incident Response

A retail company is getting complaints from customers about how long product pages are taking to load, which is causing a decline in sales. Which of the following actions should you take first to discover the source of the problem?

You have had a data breach in your organization and employees have submitted their mobile devices for review. You look through each device’s interface and take pictures of evidence you see on the screen. Which type of data acquisition have you just performed?

Which method can you use to verify that a bit-level image copy of a hard drive is an exact clone of the original hard drive collected as evidence?

Which of the following BEST describes system logs?

You have been asked to crack the password on a zip file for the CEO. The employee who sent it to the CEO told them the password over the phone, but the CEO forgot it, and the employee who knows the password is unavailable for the next week. You are using John the Ripper on Linux to recover the password. You transferred the file to your Linux machine and ensured that John the Ripper is installed, but you receive the following message. Which step did you skip?

An employee has asked for help with some files they accidentally deleted from their machine. They were a training schedule and a resume for a new employee named Jack. You access the machine, install Recuva, and run it. You point to the directory where the files were located, but you only see one file can be recovered. How do you best explain this?

Which of the following BEST describes scan information?

Which of the following best describes a wireless access point?

An incident that impacts a company’s primary functions to the point that it cannot continue with business as usual is considered to have which type of impact?

You are assigned the task of reviewing incoming and outgoing traffic on a Windows server that has been reported as sluggish. There are no servers or appliances on the segment that can capture the traffic to the machine, so you will run your own tool. Which tool will provide you with live data, showing connections, ports, protocols, and volume of traffic similar to the image below?

Which of the following BEST describes a high-value asset?

A manager is asking questions about why you must use a disk wiping utility before donating old hardware to a charity.

How would you answer that question?

Which of the following is the MOST challenging part of gathering forensic data in a cloud environment?

During a recent site survey, you found a rogue wireless access point on your network. Which of the following actions should you take first to protect your network while still preserving evidence?

Vulnerability scanning has its limitations. Which answer BEST describes the concept of point in time?

Which of the following packet crafting software programs can be used to modify flags and adjust other packet content?

Which type of scan turns on an abundance of flags, causing the packet to be lit up?

Which method involves considering all an incident’s details and taking action to keep the incident from happening again.

Using Wireshark filtering, you want to see all traffic except IP address 192.168.142.3. Which of the following is the best command to filter a specific source IP address?