Question 1

A security architect is working in a processing center and must implement a DLP solution to detect and prevent any type of copy and paste attempts of sensitive data within unapproved applications and removable devices. Which technical architecture must be used?

Accepted Answer

A)  DLP for data in motion 
B)  DLP for removable data 
C)  DLP for data in use 
D)  DLP for data at rest

Question 2

Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?

Accepted Answer

A)  chmod 666 
B)  chmod 774 
C)  chmod 775 
D)  chmod 777

Question 3

What is the HTTP response code when the REST API information requested by the authenticated user cannot be found?

Accepted Answer

A)  401 
B)  402 
C)  403 
D)  404 
E)  405

Question 4

A security manager received an email from an anomaly detection service, that one of their contractors has downloaded 50 documents from the company's confidential document management folder using a company-owned asset al039-ice-4ce687TL0500. A security manager reviewed the content of downloaded documents and noticed that the data affected is from different departments. What are the actions a security manager should take?

Accepted Answer

A)  Measure confidentiality level of downloaded documents. 
B)  Report to the incident response team. 
C)  Escalate to contractor's manager. 
D)  Communicate with the contractor to identify the motives.

Question 5

A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?

Accepted Answer

A)  Determine the systems involved and deploy available patches 
B)  Analyze event logs and restrict network access 
C)  Review access lists and require users to increase password complexity 
D)  Identify the attack vector and update the IDS signature list

Question 6

Refer to the exhibit. Which code snippet will parse the response to identify the status of the domain as malicious, clean or undefined?

Accepted Answer

A)   
B)   
C)   
D)

Question 7

What do 2xx HTTP response codes indicate for REST APIs?

Accepted Answer

A)  additional action must be taken by the client to complete the request 
B)  the server takes responsibility for error status codes 
C)  communication of transfer protocol-level information 
D)  successful acceptance of the client's request

Question 8

Refer to the exhibit. An engineer is performing a static analysis on a malware and knows that it is capturing keys and webcam events on a company server. What is the indicator of compromise?

Accepted Answer

A)  The malware is performing comprehensive fingerprinting of the host, including a processor, motherboard manufacturer, and connected removable storage. 
B)  The malware is a ransomware querying for installed anti-virus products and operating systems to encrypt and render unreadable until payment is made for file decryption. 
C)  The malware has moved to harvesting cookies and stored account information from major browsers and configuring a reverse proxy for intercepting network activity. 
D)  The malware contains an encryption and decryption routine to hide URLs/IP addresses and is storing the output of loggers and webcam captures in locally encrypted files for retrieval.

Question 9

Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop has automatically submitted a low prevalence file to the Threat Grid analysis engine for further analysis. What should be concluded from this report?

Accepted Answer

A)  The prioritized behavioral indicators of compromise do not justify the execution of the "ransomware" because the scores do not indicate the likelihood of malicious ransomware. 
B)  The prioritized behavioral indicators of compromise do not justify the execution of the "ransomware" because the scores are high and do not indicate the likelihood of malicious ransomware. 
C)  The prioritized behavioral indicators of compromise justify the execution of the "ransomware" because the scores are high and indicate the likelihood that malicious ransomware has been detected. 
D)  The prioritized behavioral indicators of compromise justify the execution of the "ransomware" because the scores are low and indicate the likelihood that malicious ransomware has been detected.

Question 10

Refer to the exhibit. An engineer notices a significant anomaly in the traffic in one of the host groups in Cisco Secure Network Analytics (Stealthwatch) and must analyze the top data transmissions. Which tool accomplishes this task?

Accepted Answer

A)  Top Peers 
B)  Top Hosts 
C)  Top Conversations 
D)  Top Ports

Question 11

A company launched an e-commerce website with multiple points of sale through internal and external e-stores. Customers access the stores from the public website, and employees access the stores from the intranet with an SSO. Which action is needed to comply with PCI standards for hardening the systems?

Accepted Answer

A)  Mask PAN numbers 
B)  Encrypt personal data 
C)  Encrypt access 
D)  Mask sales details

Question 12

An engineer has created a bash script to automate a complicated process. During script execution, this error occurs: permission denied. Which command must be added to execute this script?

Accepted Answer

A)  chmod +x ex.sh 
B)  source ex.sh 
C)  chroot ex.sh 
D)  sh ex.sh

Question 13

Engineers are working to document, list, and discover all used applications within an organization. During the regular assessment of applications from the HR backup server, an engineer discovered an unknown application. The analysis showed that the application is communicating with external addresses on a non-secure, unencrypted channel. Information gathering revealed that the unknown application does not have an owner and is not being used by a business unit. What are the next two steps the engineers should take in this investigation? (Choose two.)

Accepted Answer

A)  Determine the type of data stored on the affected asset, document the access logs, and engage the incident response team. 
B)  Identify who installed the application by reviewing the logs and gather a user access log from the HR department. 
C)  Verify user credentials on the affected asset, modify passwords, and confirm available patches and updates are installed. 
D)  Initiate a triage meeting with department leads to determine if the application is owned internally or used by any business unit and document the asset owner.

Question 14

A company's web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities. Which additional element is needed to calculate the risk?

Accepted Answer

A)  assessment scope 
B)  event severity and likelihood 
C)  incident response playbook 
D)  risk model framework

Question 15

Refer to the exhibit. A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?

Accepted Answer

A)  Limit the number of API calls that a single client is allowed to make 
B)  Add restrictions on the edge router on how often a single client can access the API 
C)  Reduce the amount of data that can be fetched from the total pool of active clients that call the API 
D)  Increase the application cache of the total pool of active clients that call the API

Question 16

A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days. Having the names of the 3 destination countries and the user's working hours, what must the analyst do next to detect an abnormal behavior?

Accepted Answer

A)  Create a rule triggered by 3 failed VPN connection attempts in an 8-hour period 
B)  Create a rule triggered by 1 successful VPN connection from any nondestination country 
C)  Create a rule triggered by multiple successful VPN connections from the destination countries 
D)  Analyze the logs from all countries related to this user during the traveling period

Question 17

An engineer implemented a SOAR workflow to detect and respond to incorrect login attempts and anomalous user behavior. Since the implementation, the security team has received dozens of false positive alerts and negative feedback from system administrators and privileged users. Several legitimate users were tagged as a threat and their accounts blocked, or credentials reset because of unexpected login times and incorrectly typed credentials. How should the workflow be improved to resolve these issues?

Accepted Answer

A)  Meet with privileged users to increase awareness and modify the rules for threat tags and anomalous behavior alerts 
B)  Change the SOAR configuration flow to remove the automatic remediation that is increasing the false positives and triggering threats 
C)  Add a confirmation step through which SOAR informs the affected user and asks them to confirm whether they made the attempts 
D)  Increase incorrect login tries and tune anomalous user behavior not to affect privileged accounts

Question 18

What is the impact of hardening machine images for deployment?

Accepted Answer

A)  reduces the attack surface 
B)  increases the speed of patch deployment 
C)  reduces the steps needed to mitigate threats 
D)  increases the availability of threat alerts

Question 19

What is the difference between process orchestration and automation?

Accepted Answer

A)  Orchestration combines a set of automated tools, while automation is focused on the tools to automate process flows. 
B)  Orchestration arranges the tasks, while automation arranges processes. 
C)  Orchestration minimizes redundancies, while automation decreases the time to recover from redundancies. 
D)  Automation optimizes the individual tasks to execute the process, while orchestration optimizes frequent and repeatable processes.

Question 20

Refer to the exhibit. An engineer is investigating a case with suspicious usernames within the active directory. After the engineer investigates and cross-correlates events from other sources, it appears that the 2 users are privileged, and their creation date matches suspicious network traffic that was initiated from the internal network 2 days prior. Which type of compromise is occurring?

Accepted Answer

A)  compromised insider 
B)  compromised root access 
C)  compromised database tables 
D)  compromised network

Exam 37: Implementing Cisco Enterprise Network Core Technologies (ENCOR)