312-39 100% Pass Guaranteed Download EC-COUNCIL CSA Exam PDF Q&A [Q49-Q72]

QUESTION 49
What is the correct sequence of SOC Workflow?

QUESTION 50
Which of the following attack can be eradicated by disabling of “allow_url_fopen and allow_url_include” in the php.ini file?

QUESTION 51
According to the forensics investigation process, what is the next step carried out right after collecting the evidence?

QUESTION 52
Which of the following Windows event is logged every time when a user tries to access the “Registry” key?

QUESTION 53
Which of the following is a correct flow of the stages in an incident handling and response (IH&R) process?

QUESTION 54
In which log collection mechanism, the system or application sends log records either on the local disk or over the network.

QUESTION 55
David is a SOC analyst in Karen Tech. One day an attack is initiated by the intruders but David was not able to find any suspicious events.
This type of incident is categorized into?

QUESTION 56
Which of the following data source can be used to detect the traffic associated with Bad Bot User-Agents?

QUESTION 57
Identify the type of attack, an attacker is attempting on www.example.com website.

QUESTION 58
Identify the attack, where an attacker tries to discover all the possible information about a target network before launching a further attack.

QUESTION 59
Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an incident to her for further investigation and confirmation. Charline, after a thorough investigation, confirmed the incident and assigned it with an initial priority.
What would be her next action according to the SOC workflow?

QUESTION 60
What type of event is recorded when an application driver loads successfully in Windows?

QUESTION 61
Properly applied cyber threat intelligence to the SOC team help them in discovering TTPs.
What does these TTPs refer to?

QUESTION 62
Which of the following attack can be eradicated by filtering improper XML syntax?

QUESTION 63
Which of the following stage executed after identifying the required event sources?

QUESTION 64
Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an incident to her for further investigation and confirmation. Charline, after a thorough investigation, confirmed the incident and assigned it with an initial priority.
What would be her next action according to the SOC workflow?

QUESTION 65
Which of the following directory will contain logs related to printer access?

QUESTION 66
Which of the following attack can be eradicated by using a safe API to avoid the use of the interpreter entirely?

QUESTION 67
According to the Risk Matrix table, what will be the risk level when the probability of an attack is very high, and the impact of that attack is major?
NOTE: It is mandatory to answer the question before proceeding to the next one.

QUESTION 68
Wesley is an incident handler in a company named Maddison Tech. One day, he was learning techniques for eradicating the insecure deserialization attacks.
What among the following should Wesley avoid from considering?

QUESTION 69
Which of the following fields in Windows logs defines the type of event occurred, such as Correlation Hint, Response Time, SQM, WDI Context, and so on?

QUESTION 70
An attacker, in an attempt to exploit the vulnerability in the dynamically generated welcome page, inserted code at the end of the company’s URL as follows:
http://technosoft.com.com/<script>alert(“WARNING: The application has encountered an error”);</script>.
Identify the attack demonstrated in the above scenario.

QUESTION 71
Which of the following formula represents the risk levels?

QUESTION 72
Jane, a security analyst, while analyzing IDS logs, detected an event matching Regex /((%3C)|<)((%69)|i|(%
49))((%6D)|m|(%4D))((%67)|g|(%47))[^n]+((%3E)|>)/|.
What does this event log indicate?