Question 1

Refer to the exhibit. How are tokens authenticated when the REST API on a device is accessed from a REST API client?

Accepted Answer

The answer of  Refer to the exhibit. How are...

Question 2

A SOC analyst is notified by the network monitoring tool that there are unusual types of internal traffic on IP subnet 103.921.2239.0/24. The analyst discovers unexplained encrypted data files on a computer system that belongs on that specific subnet. What is the cause of the issue?

Accepted Answer

The presence of unexplained encrypted data files suggests a malware outbreak, possibly ransomware, which encrypts files and demands a ransom for decryption.

Question 3

Employees report computer system crashes within the same week. An analyst is investigating one of the computers that crashed and discovers multiple shortcuts in the system's startup folder. It appears that the shortcuts redirect users to malicious URLs. What is the next step the engineer should take to investigate this case?

Accepted Answer

The answer of Employees report computer system crashes within the...

Question 4

A SOC analyst is investigating a recent email delivered to a high-value user for a customer whose network their organization monitors. The email includes a suspicious attachment titled "Invoice RE: 0004489". The hash of the file is gathered from the Cisco Email Security Appliance. After searching Open Source Intelligence, no available history of this hash is found anywhere on the web. What is the next step in analyzing this attachment to allow the analyst to gather indicators of compromise?

Accepted Answer

Detonating the file in a sandbox allows the analyst to safely observe the behavior of the attachment and gather indicators of compromise without risking the network.

Question 5

A Mac laptop user notices that several files have disappeared from their laptop documents folder. While looking for the files, the user notices that the browser history was recently cleared. The user raises a case, and an analyst reviews the network usage and discovers that it is abnormally high. Which step should be taken to continue the investigation?

Accepted Answer

The `sudo sysdiagnose` command is used to collect a wide range of system diagnostics, which can help in investigating the disappearance of files and abnormal network usage.

Question 6

An engineer has created a bash script to automate a complicated process. During script execution, this error occurs: permission denied. Which command must be added to execute this script?

Accepted Answer

The error "permission denied" indicates that the script does not have execute permissions. The command `chmod +x ex.sh` adds execute permissions to the script, allowing it to be run.

Question 7

What is the purpose of hardening systems?

Accepted Answer

Hardening systems involves securely configuring machines to limit the attack surface, making them less vulnerable to attacks.

Question 8

A threat actor has crafted and sent a spear-phishing email with what appears to be a trustworthy link to the site of a conference that an employee recently attended. The employee clicked the link and was redirected to a malicious site through which the employee downloaded a PDF attachment infected with ransomware. The employee opened the attachment, which exploited vulnerabilities on the desktop. The ransomware is now installed and is calling back to its command and control server. Which security solution is needed at this stage to mitigate the attack?

Accepted Answer

The answer of A threat actor has crafted and sent...

Question 9

An engineer is developing an application that requires frequent updates to close feedback loops and enable teams to quickly apply patches. The team wants their code updates to get to market as often as possible. Which software development approach should be used to accomplish these goals?

Accepted Answer

The answer of An engineer is developing an application that...

Question 10

An organization installed a new application server for IP phones. An automated process fetched user credentials from the Active Directory server, and the application will have access to on-premises and cloud services. Which security threat should be mitigated first?

Accepted Answer

The answer of An organization installed a new application server...

Question 11

Refer to the exhibit. What is occurring in this packet capture?

Accepted Answer

The answer of Refer to the exhibit. What is occurring...

Question 12

Refer to the exhibit. An engineer notices a significant anomaly in the traffic in one of the host groups in Cisco Secure Network Analytics (Stealthwatch) and must analyze the top data transmissions. Which tool accomplishes this task?

Accepted Answer

The answer of  Refer to the exhibit. An engineer...

Question 13

Refer to the exhibit. Based on the detected vulnerabilities, what is the next recommended mitigation step?

Accepted Answer

The answer of  Refer to the exhibit. Based on...

Question 14

Refer to the exhibit. What is the connection status of the ICMP event?

Accepted Answer

The answer of Refer to the exhibit. What is the...

Question 15

An analyst wants to upload an infected file containing sensitive information to a hybrid-analysis sandbox. According to the NIST.SP 800-150 guide to cyber threat information sharing, what is the analyst required to do before uploading the file to safeguard privacy?

Accepted Answer

The NIST.SP 800-150 guide emphasizes the importance of safeguarding privacy by removing personally identifiable information (PII) before sharing or uploading files to ensure sensitive data is not exposed.

Question 16

A company launched an e-commerce website with multiple points of sale through internal and external e-stores. Customers access the stores from the public website, and employees access the stores from the intranet with an SSO. Which action is needed to comply with PCI standards for hardening the systems?

Accepted Answer

Encrypting personal data is a requirement for PCI compliance.

Question 17

Refer to the exhibit. Which asset has the highest risk value?

Accepted Answer

The answer of Refer to the exhibit. Which asset has...

Question 18

What is a limitation of cyber security risk insurance?

Accepted Answer

The answer of What is a limitation of cyber security...

Question 19

Refer to the exhibit. Where is the MIME type that should be followed indicated?

Accepted Answer

The answer of  Refer to the exhibit. Where is...

Question 20

An engineer is investigating several cases of increased incoming spam emails and suspicious emails from the HR and service departments. While checking the event sources, the website monitoring tool showed several web scraping alerts overnight. Which type of compromise is indicated?

Accepted Answer

The answer of An engineer is investigating several cases of...

Exam 37: Implementing Cisco Enterprise Network Core Technologies (ENCOR)