210-255 Exam Questions

Which two potions are the primary 5-tuple components? (Choose two)

According to NIST-SP800-61R2, which option should be contained in the issue tracking system?

Employees are allowed access to internal websites. An employee connects to an internal website and IDS reports it as malicious behavior. What is this example of?

Which purpose of data mapping is true?

Which value in profiling servers in a system is true?

Which type of analysis shows what the outcome is as well how likely each outcome is?

How is confidentiality defined in the CVSS v3.0 framework?

Which CVSS metric describes the conditions that are beyond the attackers control so that an attack can be successful?

What is the common artifact that is used to uniquely identify a detected file?

What are the metric values of the confidentiality based on the CVSS framework?

Which signature type results in a legitime alert been dismissed?

Which incident handling is focused on minimizing the impact of an incident?

Which analyzing technique describe the outcome as well as how likely each outcome is?

According to NIST 86, which action describes the volatile data collection?

Which statement about collecting data evidence when performing digital forensics is true?

What is the process of remediation the network and systems and/or reconstructing so the responsible threat actor can be revealed?

You have a video of suspect entering your office the day your data has being stolen?

What define the roadmap for implementing the incident response plan?

Which of the following are examples of Linux boot loaders?

Which CSIRT category provides incident handling services to their parent organization such as a bank, a manufacturing company, a university, or a federal agency?

What does the CSIRT incident response provider usually do?

Which of the following is not an example of reconnaissance?

Which of the following is typically a responsibility of a PSIRT (Product SIRT)?

When incident data is collected, it is important that evidentiary cross-contamination is prevented. How is this accomplished?

Which option is the process of remediating the network and systems and/or reconstructing the attack so that the responsible threat actor can be revealed?

What can be addressed when using retrospective security techniques?

Which event artifact can be used to identify HTTP GET requests for a specific file?

Which of the following Linux file systems not only supports journaling but also modifies important data structures of the file system, such as the ones destined to store the file d...

What is a job in Microsoft Windows?

Which of the following file systems is more secure, scalable, and advanced?

To which category do attributes belong within the VERIS schema?

Which two statements correctly describe the victim demographics section of the VERIS schema? (Choose two.)

Which are two security goals of data normalization? (Choose two.)

Which of the following is true about journaling?

Which of the following is true about attribution in a cybersecurity investigation?

Which of the following is not true regarding the use of digital evidence?

Which of the following statements is true about processes and threads?

Which command can be used to find open ports on a system?

According to NIST SP800-86, which action describes volatile data collection?

Which statement about the collected evidence data when performing digital forensics is true?

What are the metric values for confidentiality impact in the CVSS v3.0 framework?

Which file system has 32 bits assigned to the address clusters of the allocation table?

Which example of a precursor is true?

You have a video of a suspect entering a data center that was captured on the same that files in the same data center were transferred to a computer. Which type of is this?

Which file system has 32 assigned to the address cluster of the allocation table?

Which technology is the leading industry approach used to automatically enforce NAC?

Refer to the exhibit. Which host is likely connecting to a malicious site?

Which HTTP header field is usually used in forensics to identify the type of browser used?

Which Cyber Kill Model category does attacking vulnerability belong to?

Which CVSS metric describes the conditions that are beyond the attacker's control that must be exist to exploit the vulnerability?