Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. Reconnaissance
• B

  B. Discovery
• C

  C. Initial Access
• D

  D. Defense Evasion

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. Enrich records with threat intelligence.
• B

  B. Automate workflows.
• C

  C. Generate a hypothesis.
• D

  D. Perform packet analysis.
• E

  E. Tune correlation rules.

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. By tagging output or a workspace comment with the keyword Evidence
• B

  B. By linking an indicator to the war room
• C

  C. By creating an evidence collection task and attaching a file
• D

  D. By executing a playbook with the Save Execution Logs option enabled

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. The client 10.200.3.219 is conducting active reconnaissance.
• B

  B. FortiGate is not routing the packets to the destination hosts.
• C

  C. The destination hosts are not responding.
• D

  D. FortiGate is blocking the return flows.

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. {{ vars.input.params.<variable_name> }}
• B

  B. {{ globalVars.<variable_name> }}
• C

  C. {{ vars.item.<variable_name> }}
• D

  D. {{ vars.steps.<variable_name> }}

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. IP addresses are easy because adversaries can spoof them or move them to new resources.
• B

  B. Tactics, techniques, and procedures are hard because adversaries must adapt their methods.
• C

  C. Artifacts are easy because adversaries can alter file paths or registry keys.
• D

  D. Tools are easy because often, multiple alternatives exist.

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. Step 1 > Create a parameter in the child playbook.
• B

  B. Step 2 > Create a parameter in the parent playbook.
• C

  C. Step 3 > Map data to the parameter in the Reference a playbook step in the parent playbook.
• D

  D. No option D

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. Group By attributes
• B

  B. Data source
• C

  C. Time window
• D

  D. Search filter
• E

  E. Incident action

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. The null value cannot be used with the IS NOT operator.
• B

  B. The time range must be Absolute for queries that use configuration management database (CMDB) groups.
• C

  C. There are missing parentheses between the first row (Group: Europe) and the second row (Group: Asia).
• D

  D. The Source IP row operator must be BETWEEN 10.0.0.0, 10.200.200.254.
• E

  E. The logical operator for the first row (Group: Europe) must be OR.

Discussions

Discussions hidden. Click reveal to view 1 linked thread.

Answers

Correct answer and vote data stay hidden until you click reveal.

• A

  A. Forward all firewall logs to the security information and event management (SIEM) system.
• B

  B. Enable deep inspection on firewall policies.
• C

  C. Implement macrosegmentation.
• D

  D. Remove unused devices.

Discussions

Discussions hidden. Click reveal to view 1 linked thread.