Question 1

An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?

Accepted Answer

C

Question 2

Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?

Accepted Answer

The command `chmod 777` sets read, write, and execute permissions for the owner, group, and others, allowing everyone full access to the folder.

Question 3

An engineer received an alert of a zero-day vulnerability affecting desktop phones through which an attacker sends a crafted packet to a device, resets the credentials, makes the device unavailable, and allows a default administrator account login. Which step should an engineer take after receiving this alert?

Accepted Answer

C

Question 4

Refer to the exhibit. A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?

Accepted Answer

The answer of Refer to the exhibit. A threat actor...

Question 5

Refer to the exhibit. An engineer is analyzing this Vlan0392-int12-239.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?

Accepted Answer

The answer of  Refer to the exhibit. An engineer...

Question 6

A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?

Accepted Answer

The answer of A threat actor used a phishing email...

Question 7

Refer to the exhibit. How must these advisories be prioritized for handling?

Accepted Answer

The answer of  Refer to the exhibit. How must...

Question 8

What do 2xx HTTP response codes indicate for REST APIs?

Accepted Answer

2xx HTTP response codes indicate that the client's request was successfully received, understood, and accepted by the server.

Question 9

The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?

Accepted Answer

The answer of The incident response team was notified of...

Question 10

The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?

Accepted Answer

The immediate step is to identify the movement of the attacker in the enterprise to understand the extent of the breach and potential risks.

Question 11

A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?

Accepted Answer

The first action in incident response is typically to contain the threat to prevent further spread, which involves isolating critical hosts from the network.

Question 12

Refer to the exhibit. At which stage of the threat kill chain is an attacker, based on these URIs of inbound web requests from known malicious Internet scanners?

Accepted Answer

The answer of  Refer to the exhibit. At which...

Question 13

Refer to the exhibit. Which data format is being used?

Accepted Answer

The answer of  Refer to the exhibit. Which data...

Question 14

An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

Accepted Answer

The answer of An organization had a breach due to...

Question 15

Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop automatically submitted a low prevalence file to the Threat Grid analysis engine. What should be concluded from this report?

Accepted Answer

The answer of  Refer to the exhibit. Cisco Advanced...

Question 16

A new malware variant is discovered hidden in pirated software that is distributed on the Internet. Executives have asked for an organizational risk assessment. The security officer is given a list of all assets. According to NIST, which two elements are missing to calculate the risk assessment? (Choose two.)

Accepted Answer

To calculate a risk assessment according to NIST, you need to understand the vulnerabilities of the assets (B) and have an analysis of the malware to understand its potential impact (E).

Question 17

Refer to the exhibit. What results from this script?

Accepted Answer

The answer of  Refer to the exhibit. What results...

Question 18

Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop has automatically submitted a low prevalence file to the Threat Grid analysis engine for further analysis. What should be concluded from this report?

Accepted Answer

The answer of  Refer to the exhibit. Cisco Advanced...

Question 19

According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?

Accepted Answer

Conducting a data protection impact assessment (DPIA) is a requirement under GDPR to ensure that data processing activities are compliant and that risks to data confidentiality, integrity, and availability are identified and mitigated.

Question 20

A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?

Accepted Answer

The answer of A payroll administrator noticed unexpected changes within...

Exam 37: Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?

A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?

Refer to the exhibit. How must these advisories be prioritized for handling?

What do 2xx HTTP response codes indicate for REST APIs?

The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?

A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?

Refer to the exhibit. At which stage of the threat kill chain is an attacker, based on these URIs of inbound web requests from known malicious Internet scanners?

Refer to the exhibit. Which data format is being used?

An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop automatically submitted a low prevalence file to the Threat Grid analysis engine. What should be concluded from this report?

Refer to the exhibit. What results from this script?

Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop has automatically submitted a low prevalence file to the Threat Grid analysis engine for further analysis. What should be concluded from this report?

According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?

A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?