Liam, a senior incident responder at a manufacturing company, is alerted to an email campaign distributing malware through fake invoice attachments. He confirms that some users opened the attachment, resulting in system slowdown and unauthorized access attempts. He disconnects affected machines, scans and removes malware, disables compromised accounts, restores systems from clean backups, and documents file hashes, sender IPs, and malicious domains. Which of the following best describes Liam’s objective?
Which of the following is not a countermeasure to eradicate cloud security incidents?
A cloud service provider detected anomalous activities pointing to a potential compromise of their infrastructure. The IH & R team is confronted with vast amounts of data from various cloud-native logging mechanisms. To ensure swift and effective incident triage, what should be their primary course of action?
Jason, a cybersecurity analyst in the incident response team, begins investigating several complaints from employees who received emails urgently requesting wire transfers to an overseas account. The emails appeared to come from the company’s CEO, using a tone of authority and pressure to bypass standard procedures. Upon closer inspection, Jason identifies that the sender ' s email address includes a minor alteration in the domain name—a form of domain spoofing. He examines the email headers, confirms the falsified sender identity, and cross-checks with the actual CEO’s activity logs to ensure there was no internal compromise. Immediately, Jason blocks the sender’s IP address at the firewall level, alerts the finance department to prevent any unauthorized transactions, and issues a company-wide advisory about the impersonation attempt. What type of phishing is Jason handling?
In which of the following types of fuzz testing strategies the new data will be generated
from scratch and the amount of data to be generated are predefined based on the
testing model?
A company facing a wave of spoofed payment emails launched an investigation and found that employees had unknowingly interacted with malicious sender domains. Despite blocking initial IPs and purging visible email content, similar threats resurfaced using altered variants. The team moved to eliminate recurring delivery mechanisms and close technical loopholes. Which step is most aligned with this eradication initiative?
After deploying a new application on Google Cloud Platform (GCP), a security engineer discovers that an unauthorized entity has been accessing the application ' s backend services. Which of the following measures should the engineer take first to address this security incident?
A multinational law firm suffered a sophisticated malware attack that encrypted critical legal documents and disrupted access to client records across several regional offices. After isolating infected infrastructure and eradicating active threats, the incident response team enters the recovery phase, aiming to restore systems and resume operations globally.
Plans involve using archived contents and collaboration media; however, threat intelligence reports suggest that some of these archives may originate from already compromised environments. This raises concern about reinfection risks if latent malware is unknowingly reintroduced during system restoration. To prevent reinfection, ensure service continuity, and avoid legal and reputational consequences, recovery must be executed securely and with caution. Given this context, which recovery-focused action should the organization prioritize to ensure the safe reconstitution of its systems and services?
David, a certified digital first responder, arrives at the scene of a reported security breach in the HR department of a corporate office. The breach involves multiple digital endpoints, including desktop systems and mobile devices. Upon entering the scene, David observes that one desktop computer is still powered ON and logged in, showing a sensitive financial dashboard on the screen. Realizing the importance of preserving this evidence, David refrains from interacting directly with the keyboard or running applications. Instead, he takes high-resolution photographs of the screen to capture the current session details, including open applications and time-sensitive data. To avoid altering the system state, David gently moves the mouse without clicking, just enough to dismiss a screen saver without triggering any on-screen changes. He records the system’s behavior, notes any visible alerts or programs running, and tags all connected cables and peripheral ports for proper documentation. What step in the evidence handling process is David demonstrating?
For analyzing the system, the browser data can be used to access various credentials.
Which of the following tools is used to analyze the history data files in Microsoft Edge browser?
