Compressing files

Identifying a device or network interface on an IP network

Creating user passwords

Physically locking a computer

Scanning paper documents

Storing only encrypted backups

Creating local user passwords

Forwarding network traffic between different networks

Creates operating system accounts

Translates domain names into IP addresses

Blocks all incoming email

Encrypts the computer hard drive

It provides connection-oriented and reliable data delivery

It is a type of computer virus

It is a physical network cable

It is used only to encrypt passwords

Create website graphics

Increase hard drive capacity

Control network traffic according to security rules

Repair damaged computer hardware

Freeware

Malware

Middleware

Firmware

Phishing

Load balancing

Software patching

Data compression

It requires more than one type of evidence to authenticate a user

It removes the need for user accounts

It makes every password publicly visible

It automatically grants administrator access

Sharing passwords with colleagues for convenience

Using a long, unique password or passphrase for each important account

Using the same short password for every account

Writing the password in a public profile

Automatically create administrator accounts

Transform data so that unauthorized parties cannot easily read it

Increase Internet connection speed

Delete all copies of data permanently

It always allows the original input to be recovered directly

It physically destroys a storage device

It produces a fixed-size digest commonly used to verify data integrity

It is primarily used to route packets between networks

A type of backup schedule

A weakness that could potentially be exploited

A physical network address

A guaranteed successful attack

They replace all security policies

They guarantee that phishing emails cannot arrive

They eliminate the need for backups

They can fix known vulnerabilities in software

Anonymous users should control security settings

Passwords should never be required

Every user should receive administrator privileges

Users should receive only the access needed to perform their tasks

Increasing network bandwidth

Preventing unauthorized disclosure of information

Ensuring a server is always physically large

Deleting all historical records

Making information available to everyone

Using only wireless connections

Protecting information from unauthorized or improper modification

Keeping all systems disconnected from networks

They make authentication unnecessary

They automatically identify every attacker

They prevent every cyberattack from occurring

They can help restore data and operations after data loss or certain incidents

Delete every system log immediately

Follow the organization's incident response process and contain the threat as appropriate

Ignore the warning until the computer stops working

Publish all passwords on the Internet

Designing social media page colors

Installing additional computer memory

Manipulating people into revealing information or performing unsafe actions

Compressing network packets

192.168.10.128

192.168.10.192

192.168.10.0

192.168.10.64

RST, ACK, SYN

SYN, SYN-ACK, ACK

SYN, FIN, ACK

ACK, SYN, FIN

The server cannot calculate an IP checksum

The client cannot reliably authenticate the identity of the intended server

The TCP connection cannot contain encrypted payloads

DNS can no longer resolve any domain

SQL injection

Cross-site scripting (XSS)

ARP spoofing

DNS zone transfer

Whether the monitor resolution changed

Whether DNS TTL values are too high

Whether the workstation needs disk defragmentation

Whether the account may have been compromised through password guessing or credential abuse

Disable the corporate firewall

Delete all security logs before investigating

Contain or isolate the endpoint while preserving evidence and begin investigation

Immediately reinstall every endpoint in the organization

It prevents the account from authenticating to Windows

Compromise of such an account can provide extensive control over domain resources

It limits the account to read-only access

It automatically disables Kerberos

Privilege escalation

Reconnaissance only

Data compression

DNS resolution

Normal ARP cache expiration

A standard TLS certificate renewal

Potential Kerberos service-ticket abuse such as Kerberoasting-related activity

Routine DHCP address renewal

Network address translation

Certificate pinning

Lateral movement

Data deduplication

Always the vulnerability with the newest publication date regardless of exposure

The isolated test-system vulnerability solely because both CVSS scores are similar

The Internet-exposed vulnerability affecting the critical authentication server

Neither vulnerability because CVSS scores cannot be used at all

Possible command-and-control beaconing

Routine keyboard driver activity

Normal monitor power management

Local file fragmentation

Hunt for behavioral patterns and correlated telemetry associated with the intrusion technique

Disable all endpoint logging

Ignore process and authentication telemetry

Search only for the exact domain forever

Only the printer queue

Only the monitor configuration

A properly acquired memory image from the affected system

Only the DNS registrar contact information

The workload will necessarily lose network connectivity

Excessive IAM privileges could significantly increase the impact of workload compromise

TLS will automatically become disabled

The storage objects will automatically become public regardless of all other controls

An attacker may be able to issue certificates that appear trusted within the affected trust hierarchy

Every encrypted historical file can always be decrypted directly from the CA key

Kerberos automatically changes every user password

All IPv4 addresses immediately stop functioning

A TLS handshake automatically authenticated the workstation to all servers

A DNS cache refresh caused legitimate administrative authentication

Normal DHCP behavior generated Kerberos credentials

Credential-focused Kerberos abuse may have enabled credential recovery or misuse followed by lateral movement

Reinstall the operating system immediately before collecting any evidence

Delete event logs to reduce disk usage

Acquire volatile evidence such as memory and relevant live-state data before destructive remediation when operationally safe

Power-cycle the system repeatedly to clear suspicious processes

Behavior-based detection using stable execution and credential-access patterns

Detection based exclusively on one known file hash

Matching only the original malware filename

Blocking only the first observed IP address

Block only the first external IP address and close the incident

Delete the suspicious document and assume the incident is resolved

Correlate endpoint, identity, and network evidence; scope affected assets and accounts; contain the intrusion; preserve evidence; eradicate persistence; and rotate compromised credentials according to the incident plan

Reset one user password without investigating the affected servers