CYSA TEST EXAM QUESTIONS AND ANSWERS VERIFIED 100% CORRECT

CYSA TEST EXAM QUESTIONS AND ANSWERS VERIFIED 100% CORRECT What type of visualization is most suitable for identifying traffic spikes? - ANSWER A line graph is a good way of showing changes in volume over time. You need to analyze the destination IP address and port number from some firewall data. The data in the iptables file is in the following format: DATE,FACILITY,CHAIN,IN,SRC,DST,LEN,TOS,PREC,TTL,ID,PROTO,SPT,DPT Jan 11 05:33:59,lx1 kernel: iptables,INPUT,eth0,10.1.0.102,10.1.0.1,52,0x00,0x00,128,2242,TCP,2564,21 Write the command to select only the necessary data, and sort it by destination port number. - ANSWER The following command selects columns 6 (destination IP address) and 14 (destination port) and then sorts by column 2—remember that the piped output to the sort command has two columns, not 14. The -n switch makes the sort order numeric rather than alphabetical. cut -d "," -f6,14 iptables | sort -t "," -k2 -n Working with the same data file, write the command to show only the lines where the destination IP address is 10.1.0.10 and the destination port is 21. - ANSWER The easiest way to do this is to pipe the result from one grep command into another. Remember that you need to escape characters such as periods and commas. The $ operator in the second command is a handy way of selecting the destination port, which is at the end of the line. grep "10.1.0.10," iptables-csv | grep "21$" Note that you need to include the comma delimiter to avoid selecting partial source IP addresses. The regex "10.1.0.10" would match 10.1.0.102. Which four phases outline the procedures involved in a forensics investigation? - ANSWER Identification, collection, analysis, and reporting. Why might a forensics investigator need to be hired on a work product retention basis? - ANSWER To protect analysis of evidence from disclosure to opposing counsel, should a court case be involved. To preserve evidence of a temporary file system mounted to a host, which system device must you target for evidence collection? - ANSWER System memory (RAM) You must contain a host that is suspected of effecting a violation of security policy. No methods of live evidence acquisition are available. What is your best course of action to preserve the integrity of evidence? - ANSWER Using a software shut-down routine risks changing data on the host disk, so if live memory acquisition cannot be performed, pulling the plug to terminate processes is the best course of action. This process should ideally be video recorded with an explanation as to why this course of action is being taken. A hard disk has been removed from a computer so that it can be subjected to forensic evidence collection. What steps should you take to complete this process? - ANSWER Ideally, record or document the process. Attach the disk to a forensic workstation, using a write blocker to prevent contaminating the source-disk contents. Make a cryptographic hash of the disk contents. Make an image of the disk contents. Make a cryptographic hash of the image and verify it matches the source disk hash. Make a copy of the image and validate with a cryptographic hash. Perform analysis on the copy of the image. What two types of space on a disk are analyzed by file-carving tools? - ANSWER Unallocated space (clusters marked as free for use in file-write operations) and slack space (cluster portions that were not overwritten when a new file was created). Which network-related potential indicator of compromise has been omitted from the following list? Bandwidth consumption, irregular peer-to-peer communication, rogue device on the network, scan/sweep, unusual traffic spike, common protocol over nonstandard port. - ANSWER Beaconing. PKI (Public Key Infrastructure) - ANSWER enables users of a public network such as the Internet to securely and privately exchange data through the use of a pair of keys— a public one and a private one—that is obtained from a trusted authority and shared through that authority. Which two main classes of attack would you suspect if you observe a bandwidth consumption IoC from a client workstation on the local network to a host on the Internet? - ANSWER You are most likely to suspect a data exfiltration attack, but it is also possible that the host has been infected with a bot and is being used for DDoS or spam. What steps would you take to investigate irregular peer-to-peer communication? - ANSWER Start an incident response ticket and log all actions taken. Identify the IP addresses involved. On a LAN, work out the identity of each host and the accounts and services running on them. On the Internet, use IP reputation services and geolocation to identify the host(s). Raise the logging and packet capture level to monitor the communications. Try to identify the traffic—if it contains sensitive data, consider closing the channel to prevent further release of information. Your firewall log shows that the following packet was dropped—what application protocol was the sender trying to access? IN=eth0 OUT= MAC=00:15:5d:01:ca:55:00:15:5d:01:ca:ad:08:00 SRC=172.16.0.192 DST=192.168.0.22 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=4018 DF PROTO=TCP SPT=2584 DPT=135 WINDOW=64240 RES=0x00 SYN URGP=0 - ANSWER The destination port (DPT) is 135, which is Microsoft Remote Procedure Call (RPC). This advertises what RPC services are available in a Windows environment. Your border firewall uses a default allow policy, but you want to block outgoing requests for UPnP. Which port do you need to create a deny rule for? - ANSWER UDP port 1900. Why might a host-related IoC manifest as abnormal OS process behavior rather than as a malicious process? - ANSWER A malicious process is relatively easy to identify. Advanced malware disguises its presence using techniques such as process hollowing and DLL injection/sideloading to compromise legitimate OS and application processes. What type of evidence can be retrieved from system memory analysis? - ANSWER Reverse engineer the code used by processes, discover how processes are interacting with the file system (handles) and Registry, examine network connections, retrieve cryptographic keys, and extract interesting strings. Why are CPU, memory, and disk space consumption IoCs used to identify incidents? - ANSWER Detailed analysis of processes and file systems is detailed and timeconsuming work. Anomalous resource consumption is easier to detect and can be used to prioritize cases for investigation, though there is a substantial risk of numerous false positives. What type of security information is primarily used to detect unauthorized privilege IoCs? - ANSWER Detecting this type of IoC usually involves collecting security events in an audit log. What are the main types of IoCs that can be identified through analysis of the Registry? - ANSWER You can audit applications that have been most recently used (MRU) and look for use of persistence mechanisms in the Run, RunOnce, and Services keys. Another common tactic for malware is to change file associations via the Registry. You are assisting an incident responder with an overview of application-related IoCs. What are the unexpected output indicators of intrusion events? - ANSWER One approach is to analyze network protocol response packets for unusual size and content.