A forensic investigator is examining a Windows workstation that was used to access a company's internal web application during a breach. The investigator wants to find evidence of the user's activity, including which files were accessed and when. Which two sources of digital evidence would be most useful for this purpose?

Windows Event Logs and the NTFS $MFT (Master File Table)

The browser's cache and the system's RAM

The firewall logs and the proxy logs

During an intrusion analysis, an analyst identifies that the attacker used a known exploit kit to compromise a web server, and the exploit kit was hosted on a domain that was registered specifically for this attack. The analyst also knows the victim is a small e-commerce company. Using the Diamond Model, which two elements are the 'capability' and the 'infrastructure'?

Capability: the attacker; Infrastructure: the exploit kit

Capability: the registered domain; Infrastructure: the exploit kit

Capability: the exploit kit; Infrastructure: the registered domain

Capability: the web server; Infrastructure: the e-commerce company

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 5Objective 2

Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 7)

Part of the Incident Handling domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 31–35

31foundation · easy
Which phase of the Cyber Kill Chain involves the attacker gathering information about the target, such as open ports, software versions, and employee names?
Select an answer first
32application · medium
A forensic investigator is examining a Windows workstation that was used to access a company's internal web application during a breach. The investigator wants to find evidence of the user's activity, including which files were accessed and when. Which two sources of digital evidence would be most useful for this purpose?
Select an answer first
33application · medium
During an intrusion analysis, an analyst identifies that the attacker used a known exploit kit to compromise a web server, and the exploit kit was hosted on a domain that was registered specifically for this attack. The analyst also knows the victim is a small e-commerce company. Using the Diamond Model, which two elements are the 'capability' and the 'infrastructure'?
Select an answer first
34application · medium
A threat intelligence analyst is writing a report about an attack. The analyst notes that the adversary used a specific exploit kit to deliver ransomware. In TTP terminology, what is the exploit kit an example of?
Select an answer first
35foundation · easy
In the Diamond Model, which feature includes the malware, exploits, and tools used by an adversary?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 7)

Questions 31–35

Which phase of the Cyber Kill Chain involves the attacker gathering information about the target, such as open ports, software versions, and employee names?

A threat intelligence analyst is writing a report about an attack. The analyst notes that the adversary used a specific exploit kit to deliver ransomware. In TTP terminology, what is the exploit kit an example of?

In the Diamond Model, which feature includes the malware, exploits, and tools used by an adversary?

Keep studying — Incident Handling