NO.123 Which of the following is an inappropriate usage incident?

NO.124 The program that helps to train people to be better prepared to respond to emergency situations in their communities is known as:

NO.125 Which of the following confidentiality attacks do attackers try to lure users by posing themselves as authorized AP by beaconing the WLAN’s SSID?

NO.126 A distributed Denial of Service (DDoS) attack is a more common type of DoS Attack, where a single system is targeted by a large number of infected machines over the Internet. In a DDoS attack, attackers first infect multiple systems which are known as:

NO.127 Which of the following options describes common characteristics of phishing emails?

NO.128 The product of intellect that has commercial value and includes copyrights and trademarks is called:

NO.129 Contingency planning enables organizations to develop and maintain effective methods to handle
emergencies. Every organization will have its own specific requirements that the planning should address.
There are five major components of the IT contingency plan, namely supporting information, notification
activation, recovery and reconstitution and plan appendices. What is the main purpose of the reconstitution
plan?

NO.130 An audit trail policy collects all audit trails such as series of records of computer events, about an operating
system, application or user activities. Which of the following statements is NOT true for an audit trail policy:

NO.131 Johnson is an incident handler and is working on a recent web application attack faced by his organization. As part of this process, he performed data preprocessing in order to analyze and detect the watering hole attack. Johnson preprocessed the outbound network traffic data collected from firewalls and proxy servers. He then started analyzing the user activities within a certain time period to create time ordered domain sequences to perform further analysis on sequential patterns. Identify the data-preprocessing step performed by Johnson.

NO.132 According to the Evidence Preservation policy, a forensic investigator should make at least ………………… image
copies of the digital evidence.

NO.133 The sign(s) of the presence of malicious code on a host infected by a virus which is delivered via e-mail could be:

NO.134 ADAM, an employee from a multinational company, uses his company’s accounts to send e-mails to a third
party with their spoofed mail address. How can you categorize this type of account?

NO.135 As an IT security officer, what is the first step you will take after discovering a successful email compromise?

NO.136 Lack of forensic readiness may result in:

NO.137 Eve is an incident handler in ABC organization. One day, she got a complaint about an email hacking incident from one of the employees of the organization. As a part of incident handling and response process, she must follow a number of recovery steps in order to recover from the incident impact and maintain business continuity.
What is the first step that she must do to secure the employee’s account?

NO.138 Agencies do NOT report an information security incident is because of:

NO.139 An attacker uncovered websites a target individual was frequently Suring. The attacker then tested those particular websites to identify possible vulnerabilities. After detecting vulnerabilities within a website, the attacker started injecting malicious script/code into the web application that would redirect the webpage and download the malware on to the victim’s machine. After infecting the vulnerable web application, the attacker waited for the victim to access the infected web application. Identify the type of attack performed by the attacker.

NO.140 Dash wants to perform a DoS attack over 256 target URLs simultaneously.
Which of the following tools can Dash employ to achieve his objective?

NO.141 Michael is an incident handler at CyberTech Solutions. He is performing detection and analysis of a cloud security incident. He is also analyzing the file systems, slack spaces, and metadata within the storage units to find hidden malware and evidence of malice.
Identify the cloud security incident handled by Michael:

NO.142 Which of the following information security personnel handles incidents from management and technical point of view?

NO.143 Eric works as an incident handler at Erinol software systems. He was assigned a task to protect the organization from any kind of DoS/DDoS attacks.
Which of the following tools can be used by Eric to achieve his objective?

NO.144 Robert is an incident handler working for X security Inc. One day, his organization faced a massive cyberattack and all of the websites related to the organization went offline. Robert was on duty during the incident and he was responsible for handling the incident and maintaining business continuity. He immediately restored the web application service with the help of the existing backups.
According to the scenario, which of the following stages of incident handling and response (IH&R) process did Robert perform?

NO.145 Which of the following is a technique used by attackers to make a message difficult to understand through the use of ambiguous language?

NO.146 An active vulnerability scanner featuring high speed discovery, configuration auditing, asset profiling, sensitive data discovery, and vulnerability analysis is called: