210-255 Exam Questions

Which option can be addressed when using retrospective security techniques?

Which CVSSv3 Attack Vector metric value requires the attacker to physically touch or manipulate the vulnerable component?

Which kind of evidence can be considered most reliable to arrive at an analytical assertion?

Which string matches the regular expression r(ege)+x?

Which statement about threat actors is true?

Which data element must be protected with regards to PCI?

What mechanism does the Linux operating system provide to control access to files?

Refer to the exhibit. What can be determined from this ping result?

Which element is part of an incident response plan?

Which source provides reports of vulnerabilities in software and hardware to a Security Operations Center?

What information from HTTP logs can be used to find a threat actor?

An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. Which term defines the initial event in the NIST SP800- 61...

You have run a suspicious file in a sandbox analysis tool to see what the file does. The analysis report shows that outbound callouts were made post infection. Which two pieces of...

Which option filters a LibPCAP capture that used a host as a gateway?

Which type of analysis allows you to see how likely an exploit could affect your network?

Which network device creates and sends the initial packet of a session?

When performing threat hunting against a DNS server, which traffic toward the affected domain is considered a starting point?

Refer to the exhibit. Which application protocol is in this PCAP file?

You see confidential data being exfiltrated to an IP address that is attributed to a known Advanced Persistent Threat group. Assume that this is part of a real attach and not a net...

Refer to the exhibit. We have performed a malware detection on the Cisco website. Which statement about the result is true?

Which option has a drastic impact on network traffic because it can cause legitimate traffic to be blocked?

Which CVSSv3 metric value increases when the attacker is able to modify all files protected by the vulnerable component?

During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

Which information must be left out of a final incident report?

Which two components are included in a 5-tuple? (Choose two.)

In VERIS, an incident is viewed as a series of events that adversely affects the information assets of an organization. Which option contains the elements that every event is compr...

Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?

Which two options can be used by a threat actor to determine the role of a server? (Choose two.)

Which option creates a display filter on Wireshark on a host IP address or name?

You receive an alert for malicious code that exploits Internet Explorer and runs arbitrary code on the site visitor machine. The malicous code is on an external site that is being...

Refer to the Exhibit. A customer reports that they cannot access your organization's website. Which option is a possible reason that the customer cannot access the website?

Which identifies both the source and destination location?

Which type of analysis assigns values to scenarios to see what the outcome might be in each scenario?

Which feature is used to find possible vulnerable services running on a server?

Which CVSSv3 metric value increases when attacks consume network bandwidth, processor cycles, or disk space?

Which Security Operations Center's goal is to provide incident handling to a country?

A CMS plugin creates two files that are accessible from the Internet myplugin.html and exploitable.php. A newly discovered exploit takes advantage of an injection vulnerability in...

Which goal of data normalization is true?

Which description of a retrospective malware detection is true?

Which process is being utilized when IPS events are removed to improve data integrity?

Which element is included in an incident response plan?

In Microsoft Windows, as files are deleted the space they were allocated eventually is considered available for use by other files. This creates alternating used and unused areas o...

During which phase of the forensic process are tools and techniques used to extract the relevant information from the collective data?

Which option allows a file to be extracted from a TCP stream within Wireshark?

Refer to the exhibit. Which type of log is this an example of?

Refer to the exhibit. Which type of log is this an example of?

Which element can be used by a threat actor to discover a possible opening into a target network and can also be used by an analyst to determine the protocol of the malicious traff...

Which stakeholder group is responsible for containment, eradication, and recovery in incident handling?

Refer to the exhibit. You notice that the email volume history has been abnormally high. Which potential result is true?

Which CVSSv3 metric captures the level of access that is required for a successful attack?