212-89 Exam Question 51
In a situation where an insider threat has been detected in your organization using the ActivTtak Employee Monitoring Solution, what would be the most appropriate step to handle this situation while ensuring minimal damage to the organizational resources?
212-89 Exam Question 52
During a web application security incident, the incident response team discovers that the attacker has compromised a web server and is using it to launch further attacks against other systems on the network. What is the best course of action for the incident response team during the containment phase?
212-89 Exam Question 53
Which of the following tools helps incident handlers to view the file system, retrieve deleted data, perform timeline analysis, web artifacts, etc., during an incident response process?
212-89 Exam Question 54
Following a security alert, the incident response team at a legal consulting firm suspects that an employee used a USB storage device to exfiltrate confidential client data. The employee had physical access to critical systems during off-hours. To proceed with the investigation, the team needs to confirm which USB device was connected and gather related evidence such as timestamps and device identifiers. Which method is most effective for detecting and verifying the specific USB device used in this insider incident?
212-89 Exam Question 55
ABC Corp., in the wake of frequent malware attacks, decided to conduct a forensic investigation on a suspected machine in their network. The incident response team used CurrPorts to monitor TCP/IP connections and identified a suspicious process. They also leveraged Regshot for registry entry monitoring. While analyzing the registry changes before and after the execution of a suspicious process, they noticed some entries in the startup section of the registry. Given this scenario, which of the following is the most likely reason for malware creating entries in the startup section of the registry?