An incident responder discovers that the CEO logged in from their New York City office and then logged in from a location in Beijing an hour later. The incident responder suspects that the CEO’s account has been

compromised. Which of the following anomalies MOST likely contributed to the incident responder’s suspicion?

Which of the following regulations is most applicable to a public utility provider operating in the United States?

Which of the following digital forensic goals is being provided with hashing and time-stamping of the electronic evidence?

Senior management has stated that antivirus software must be installed on all employee workstations. Which

of the following does this statement BEST describe?

A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?

What is the definition of a security breach?

Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are

MOST important for log integrity? (Choose two.)

Which of the following types of attackers would be MOST likely to use multiple zero-day exploits executed against high-value, well-defended targets for the purposes of espionage and sabotage?

Network infrastructure has been scanned and the identified issues have been remediated. What is the next step in the vulnerability assessment process?

A company that maintains a public city infrastructure was breached and information about future city projects was leaked. After the post-incident phase of the process has been completed, which of the following would be

PRIMARY focus of the incident response team?