What information is commonly found in both the header and the possession log of a Chain of Custody?
#121
Answer: B✅ Correct❌ Incorrect
Which of the following Metasploit module types would contain privilege escalation capabilities?
#122
Answer: D✅ Correct❌ Incorrect
Which of the following describes a suspicious event in the service data below? root@kali:~/volatility# ./vol.py -f ../mem/Desk005.vmem svcscan
#123
Answer: D✅ Correct❌ Incorrect
Which file contains information about failed login attempts on a Unix system?
#124
Answer: C✅ Correct❌ Incorrect
What is one of the simplest AND most common ways for an attacker to camouflage files on a UNIX system? E. Install a kernel-level rootkit
#125
Answer: C✅ Correct❌ Incorrect
Which of the following packets saved in the file pingout.pcap would be returned with the following Berkley Packet Filters? tcpdump -nn -r pingout.pcap `˜icmp and (dst host 8.8.8.8)'
#126
Answer: A✅ Correct❌ Incorrect
During the identification phase of a Web server compromise, you notice the following entries in the web server logs. If "admin" is a valid username, but its corresponding password is not "pass1", and "root" is not a valid username, what can you infer solely from these logs?
#127
Answer: D✅ Correct❌ Incorrect
Which of the following Volatility commands will display the date and time an image was collected?
#128
Answer: A✅ Correct❌ Incorrect
How would an attacker hide an executable from being viewed by Windows Explorer?
#129
Answer: B✅ Correct❌ Incorrect
Which is the normal response from live hosts to the discovery packets sent during a default Nmap sweep?
#130
Answer: A✅ Correct❌ Incorrect
Where would salted hashes be found on a Linux machine?
#131
Answer: D✅ Correct❌ Incorrect
A fake installer exploit is delivered using which attack?
#132
Answer: C✅ Correct❌ Incorrect
A company was a victim of bucket squatting. What process would help to prevent this type of attack?
#133
Answer: A✅ Correct❌ Incorrect
Which encryption algorithm was replaced with the introduction of the /etc/shadow file in the Linux OS?
#134
Answer: A✅ Correct❌ Incorrect
What can a Linux administrator use to take advantage of RADIUS?
#135
Answer: C✅ Correct❌ Incorrect
An organization needs to protect its PHP web applications from Cross-Site Scripting attacks. Which action should they take?
#136
Answer: D✅ Correct❌ Incorrect
The provided screenshot shows output from running the SysInternals "Strings" command against a suspected malware executable. Which of the following strings indicate that the attacker is attempting to gain persistence on the target system?
#137
Answer: D✅ Correct❌ Incorrect
An attacker needs to relay SMB requests to another system outside of the local subnet using Responder. Which command arguments will achieve this goal?
#138
Answer: D✅ Correct❌ Incorrect
A spike in Event ID 4625 is found in Windows event logs. Looking at individual accounts across the domain, no more than 5 failed logins are found for any single account. What is a likely explanation for this?
#139
Answer: B✅ Correct❌ Incorrect
What is the size of the data transferred in the following Squid access log?
#140
Answer: D✅ Correct❌ Incorrect
Inspecting developer code for functions like system, exec, and popen is recommended to reduce the likelihood of what type of public-facing attack?
#141
Answer: C✅ Correct❌ Incorrect
Which of the following natively supports SMB encryption?
#142
Answer: A✅ Correct❌ Incorrect
Which persistence mechanism will evade detection by Sysinternals AutoRuns?
#143
Answer: B✅ Correct❌ Incorrect
Which attack technique does the enabled setting in the screenshot mitigate?
#144
Answer: A✅ Correct❌ Incorrect
A security team is actively monitoring windows event IDs 4634, 4688, and 4697. Which persistence mechanism will they detect with this approach?
#145
Answer: C✅ Correct❌ Incorrect
Which netcat command will listen on port 2222 for connections from a remote system (10.0.0.1)?
#146
Answer: D✅ Correct❌ Incorrect
A popular forum, where ICS techniques are discussed, loads scripts and ads from multiple external sites. Which attack can an adversary use to leverage this situation to attack this particular industry?
#147
Answer: D✅ Correct❌ Incorrect
What tool would an incident handler use to search for all autostart extensibility points (ASEPs) on a Windows host?
#148
Answer: D✅ Correct❌ Incorrect
What action does the following command perform?C:\DefenderCheck.exe .\giac1.exe
#149
Answer: A✅ Correct❌ Incorrect
Which of the following dumped hashes would be most useful to an attacker?