Identifying a device or network interface on an IP network

Compressing files

Creating user passwords

Physically locking a computer

Creating local user passwords

Forwarding network traffic between different networks

Scanning paper documents

Storing only encrypted backups

Translates domain names into IP addresses

Blocks all incoming email

Creates operating system accounts

Encrypts the computer hard drive

It is a type of computer virus

It provides connection-oriented and reliable data delivery

It is used only to encrypt passwords

It is a physical network cable

Control network traffic according to security rules

Increase hard drive capacity

Create website graphics

Repair damaged computer hardware

Freeware

Malware

Middleware

Firmware

Phishing

Data compression

Software patching

Load balancing

It automatically grants administrator access

It removes the need for user accounts

It requires more than one type of evidence to authenticate a user

It makes every password publicly visible

Using the same short password for every account

Writing the password in a public profile

Sharing passwords with colleagues for convenience

Using a long, unique password or passphrase for each important account

Increase Internet connection speed

Automatically create administrator accounts

Delete all copies of data permanently

Transform data so that unauthorized parties cannot easily read it

It always allows the original input to be recovered directly

It physically destroys a storage device

It produces a fixed-size digest commonly used to verify data integrity

It is primarily used to route packets between networks

A type of backup schedule

A guaranteed successful attack

A weakness that could potentially be exploited

A physical network address

They guarantee that phishing emails cannot arrive

They eliminate the need for backups

They can fix known vulnerabilities in software

They replace all security policies

Anonymous users should control security settings

Passwords should never be required

Every user should receive administrator privileges

Users should receive only the access needed to perform their tasks

Preventing unauthorized disclosure of information

Deleting all historical records

Ensuring a server is always physically large

Increasing network bandwidth

Making information available to everyone

Using only wireless connections

Keeping all systems disconnected from networks

Protecting information from unauthorized or improper modification

They make authentication unnecessary

They can help restore data and operations after data loss or certain incidents

They prevent every cyberattack from occurring

They automatically identify every attacker

Follow the organization's incident response process and contain the threat as appropriate

Delete every system log immediately

Ignore the warning until the computer stops working

Publish all passwords on the Internet

Installing additional computer memory

Manipulating people into revealing information or performing unsafe actions

Designing social media page colors

Compressing network packets

192.168.10.128

192.168.10.64

192.168.10.192

192.168.10.0

ACK, SYN, FIN

SYN, SYN-ACK, ACK

SYN, FIN, ACK

RST, ACK, SYN

The client cannot reliably authenticate the identity of the intended server

DNS can no longer resolve any domain

The server cannot calculate an IP checksum

The TCP connection cannot contain encrypted payloads

Cross-site scripting (XSS)

ARP spoofing

SQL injection

DNS zone transfer

Whether the account may have been compromised through password guessing or credential abuse

Whether the monitor resolution changed

Whether the workstation needs disk defragmentation

Whether DNS TTL values are too high

Disable the corporate firewall

Immediately reinstall every endpoint in the organization

Delete all security logs before investigating

Contain or isolate the endpoint while preserving evidence and begin investigation

It automatically disables Kerberos

Compromise of such an account can provide extensive control over domain resources

It prevents the account from authenticating to Windows

It limits the account to read-only access

Data compression

DNS resolution

Privilege escalation

Reconnaissance only

Potential Kerberos service-ticket abuse such as Kerberoasting-related activity

Normal ARP cache expiration

Routine DHCP address renewal

A standard TLS certificate renewal

Network address translation

Data deduplication

Lateral movement

Certificate pinning

Neither vulnerability because CVSS scores cannot be used at all

The isolated test-system vulnerability solely because both CVSS scores are similar

Always the vulnerability with the newest publication date regardless of exposure

The Internet-exposed vulnerability affecting the critical authentication server

Routine keyboard driver activity

Possible command-and-control beaconing

Local file fragmentation

Normal monitor power management

Ignore process and authentication telemetry

Hunt for behavioral patterns and correlated telemetry associated with the intrusion technique

Disable all endpoint logging

Search only for the exact domain forever

Only the DNS registrar contact information

Only the monitor configuration

A properly acquired memory image from the affected system

Only the printer queue

The workload will necessarily lose network connectivity

The storage objects will automatically become public regardless of all other controls

Excessive IAM privileges could significantly increase the impact of workload compromise

TLS will automatically become disabled

An attacker may be able to issue certificates that appear trusted within the affected trust hierarchy

All IPv4 addresses immediately stop functioning

Kerberos automatically changes every user password

Every encrypted historical file can always be decrypted directly from the CA key

A DNS cache refresh caused legitimate administrative authentication

Credential-focused Kerberos abuse may have enabled credential recovery or misuse followed by lateral movement

Normal DHCP behavior generated Kerberos credentials

A TLS handshake automatically authenticated the workstation to all servers

Power-cycle the system repeatedly to clear suspicious processes

Reinstall the operating system immediately before collecting any evidence

Delete event logs to reduce disk usage

Acquire volatile evidence such as memory and relevant live-state data before destructive remediation when operationally safe

Behavior-based detection using stable execution and credential-access patterns

Blocking only the first observed IP address

Matching only the original malware filename

Detection based exclusively on one known file hash

Block only the first external IP address and close the incident

Reset one user password without investigating the affected servers

Correlate endpoint, identity, and network evidence; scope affected assets and accounts; contain the intrusion; preserve evidence; eradicate persistence; and rotate compromised credentials according to the incident plan

Delete the suspicious document and assume the incident is resolved