Tentamen (uitwerkingen)
SANS GCIH Exam 2024_2025 fully solved & updated
- Vak
- Instelling
SANS GCIH Exam 2024_2025 fully solved & updated
[Meer zien]Voorbeeld 3 van de 28 pagina's
Voorbeeld 3 van de 28 pagina's
In winkelwagen
In winkelwagen
gesponsord bericht van onze partner
Verkoper
Volgen
tuition
Ontvangen beoordelingen
Voorbeeld van de inhoud
SANS GCIH Exam 2024/2025 fully solved &updated
Who should make the decision of when to put a system back into production?
A) Systems administrators
B) Business team
C) Security team
D) Data owner - ANSWER-B) Business team
Which command will display ASCII and Unicode strings within a malware
sample?
A) cat
B) Get-Strings
C) strings
D) findstr - ANSWER-C) strings
Which type of system is most commonly used to investigate malware?
A) Virtual machine
B) Day-to-day host
C) Thick client
D) Production system - ANSWER-A) Virtual machine
If you believe your system has been the victim of a rootkit attack, what is the
most cost-effective form of eradication?
A) Restore the OS from the most recent backup.
B) Reformat, reinstall, and patch the system from the original media.
C) Patch and reboot the compromised system.
,D) Install applications from a different vendor. - ANSWER-B) Reformat, reinstall,
and patch the system from the original media.
What tool is used to record the state of the registry before and after malware is
executed on an analysis system?
A) Regshot
B) Ollydbg
C) Wireshark
D) Regripper - ANSWER-A) Regshot
What method could be used to ensure that an asset under investigation is not put
back into production without approval before the investigation is complete?
A) Move the asset to a different cloud data center.
B) Terminate the asset.
C) Shut off all administrative access to the cloud environment so no admins can
make changes.
D) Add an "under investigation" tag to the asset. - ANSWER-D) Add an "under
investigation" tag to the asset.
During the remediation phase of incident response, you remove a file from your
infected web server. What is the most important additional thing to do to prevent
being compromised again?
A) Determine the root cause of the attack.
B) Review your host-based firewall rules.
C) Restore the host data from backups.
D) Apply patches and harden the system. - ANSWER-A) Determine the root cause
of the attack.
Why is performing memory analysis on RAM images a staple of investigations?
A) Valuable information may exist in RAM, which might not be found on disk.
B) Speed - Evidence from a RAM image will match disk content.
C) RAM provides more consistent images than disk.
D) It's easier to look for historical information in RAM than on disk. - ANSWER-A)
Valuable information may exist in RAM, which might not be found on disk.
An investigator identifies the following POST request. Which log recorded the
activity?
, 1583050850.951 185 192.168.40.123 TCP_MISS/200 1856 POST
https://update.googleapis.com/service/update2? -ORIGINAL_DST/172.219.10.153
text/xml
A) Switch access log
B) Regshot event log
C) Proxy access log
D) Windows event log - ANSWER-C) Proxy access log
What are two basic approaches commonly employed when investigating
malware?
A) Running a penetration test and running a vulnerability scan.
B) Monitoring the environment and examining code.
C) Taking the environment offline and restoring from backups.
D) Performing a risk assessment and confirming a possible exploit type. -
ANSWER-B) Monitoring the environment and examining code.
What step should always be taken first during an incident?
A) Identifying which systems are unpatched.
B) Verifying whether an incident occurred.
C) Determining which threat intelligence feeds to query.
D) Choosing which systems to rebuild. - ANSWER-B) Verifying whether an
incident occurred.
In what way is logging API access to a cloud environment a major incident
response benefit?
A) It helps to provide detailed insight into network activity for analysis.
B) It helps to understand the scope of the breach and the actions taken by an
attacker.
C) It provides verification of breached data access.
D) It provides full packet capture visibility. - ANSWER-B) It helps to understand
the scope of the breach and the actions taken by an attacker.
API access logs include all programmatic access to cloud services, identity and
key use, and a record of attacker tactics used to exploit the cloud. These are the
most useful data for understanding the scope of a breach and the actions taken
by the attacker.
Voordelen van het kopen van samenvattingen bij Stuvia op een rij:
Verzekerd van kwaliteit door reviews
Stuvia-klanten hebben meer dan 700.000 samenvattingen beoordeeld. Zo weet je zeker dat je de beste documenten koopt!
Snel en makkelijk kopen
Je betaalt supersnel en eenmalig met iDeal, creditcard of Stuvia-tegoed voor de samenvatting. Zonder lidmaatschap.
Focus op de essentie
Samenvattingen worden geschreven voor en door anderen. Daarom zijn de samenvattingen altijd betrouwbaar en actueel. Zo kom je snel tot de kern!
Veelgestelde vragen
Wat krijg ik als ik dit document koop?
Je krijgt een PDF, die direct beschikbaar is na je aankoop. Het gekochte document is altijd, overal en oneindig toegankelijk via je profiel.
Tevredenheidsgarantie: hoe werkt dat?
Onze tevredenheidsgarantie zorgt ervoor dat je altijd een studiedocument vindt dat goed bij je past. Je vult een formulier in en onze klantenservice regelt de rest.
Van wie koop ik deze samenvatting?
Stuvia is een marktplaats, je koop dit document dus niet van ons, maar van verkoper tuition. Stuvia faciliteert de betaling aan de verkoper.
Zit ik meteen vast aan een abonnement?
Nee, je koopt alleen deze samenvatting voor €11,72. Je zit daarna nergens aan vast.
Is Stuvia te vertrouwen?
4,6 sterren op Google & Trustpilot (+1000 reviews)
Afgelopen 30 dagen zijn er 78075 samenvattingen verkocht
Opgericht in 2010, al 14 jaar dé plek om samenvattingen te kopen