Immediately following the report of a potential breach, a security engineer creates a forensic image of the server in question as part of the organization incident response procedure. Which of the must occur to ensure the integrity of the image?

A company in the financial sector receives a substantial number of customer transaction requests via email. While doing a root-cause analysis conceding a security breach, the CIRT correlates an unusual spike in port 80 traffic from the IP address of a desktop used by a customer relations employee who has access to several of the compromised accounts. Subsequent antivirus scans of the device do not return an findings, but the CIRT finds undocumented services running on the device. Which of the following cont

A system administrator at a medical imaging company discovers protected health information (PHI) on a general-purpose file server. Which of the following steps should the administrator take NEXT?

An analyst execute a vulnerability scan against an internet-facing DNS server and receives the following report: Which of the following tools should the analyst use FIRST to validate the most critical vulnerability? A.Password cracker B.Port scanner C.Account enumerator D.Exploitation framework

A financial institution has several that currently employ the following controls: * The severs follow a monthly patching cycle. * All changes must go through a change management process. * Developers and systems administrators must log into a jumpbox to access the servers hosting the data using two-factor authentication. * The servers are on an isolated VLAN and cannot be directly accessed from the internal production network. An outage recently occurred and lasted several days due to an upgrade that circum

Over the last 90 days, many storage services has been exposed in the cloud services environments, and the security team does not have the ability to see is creating these instance. Shadow IT is creating data services and instances faster than the small security team can keep up with them. The Chief information security Officer (CIASO) has asked the security officer (CISO) has asked the security lead architect to architect to recommend solutions to this problem. Which of the following BEST addresses the prob

A security analyst is reading the results of a successful exploit that was recently conducted by thirdparty penetration testers. The testers reverse engineered a privileged executable. In the report, the planning and execution of the exploit is detailed using logs and outputs from the test However, the attack vector of the exploit is missing, making it harder to recommend remediation's. Given the following output: The penetration testers MOST likely took advantage of: A.A TOC/TOU vulnerability B.A plain-tex