Try and practice the latest CREST : CPTIA real questions & answers

Employee monitoring tools are mostly used by employers to find which of the following?

• A. Stolen credentials
• B. Lost registry keys
• C. Conspiracies
• D. Malicious insider threats

The following steps describe the key activities in forensic readiness planning:
1. Train the staff to handle the incident and preserve the evidence
2. Create a special process for documenting the procedure
3. Identify the potential evidence required for an incident
4. Determine the source of the evidence
5. Establish a legal advisory board to guide the investigation process
6. Identify if the incident requires full or formal investigation
7. Establish a policy for securely handling and storing the collected evidence
8. Define a policy that determines the pathway to legally extract electronic evidence with minimal disruption Identify the correct sequence of steps involved in forensic readiness planning.

• A. 3-->4-->8-->7-->6-->1-->2-->5
• B. 3-->1-->4-->5-->8-->2-->6-->7
• C. 1-->2-->3-->4-->5-->6-->7-->8
• D. 2-->3-->1-->4-->6-->5-->7-->8

A threat analyst obtains an intelligence related to a threat, where the data is sent in the form of a connection request from a remote host to the server. From this data, he obtains only the IP address of the source and destination but no contextual information. While processing this data, he obtains contextual information stating that multiple connection requests from different geo-locations are received by the server within a short time span, and as a result, the server is stressed and gradually its performance has reduced. He further performed analysis on the information based on the past and present experience and concludes the attack experienced by the client organization.
Which of the following attacks is performed on the client organization?

• A. Distributed Denial-of-Service (DDoS) attack
• B. DHCP attacks
• C. Bandwidth attack
• D. MAC spoofing attack

John, a professional hacker, is trying to perform APT attack on the target organization network. He gains access to a single system of a target organization and tries to obtain administrative login credentials to gain further access to the systems in the network using various techniques.
What phase of the advanced persistent threat lifecycle is John currently in?

• A. Search and exfiltration
• B. Expansion
• C. Initial intrusion
• D. Persistence

During the process of detecting and containing malicious emails, incident responders should examine the originating IP address of the emails.
The steps to examine the originating IP address are as follow:
1. Search for the IP in the WHOIS database
2. Open the email to trace and find its header
3. Collect the IP address of the sender from the header of the received mail
4. Look for the geographic address of the sender in the WHOIS database
Identify the correct sequence of steps to be performed by the incident responders to examine originating IP address of the emails.

• A. 4-->1-->2-->3
• B. 2-->1-->4-->3
• C. 2-->3-->1-->4
• D. 1-->3-->2-->4