View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 181. Which telemetry best reveals abnormal use of a legitimate administrative utility? Disk capacity Command execution logs Screen brightness Printer status Correct Answer: 2 Explanation: Command execution logs can reveal how administrative utilities are being used on an endpoint. Attackers often abuse legitimate […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 161. Which artifact can reveal recently mounted removable storage? Browser history DNS cache Display profiles Device connection records Correct Answer: 4 Explanation: Device connection records can reveal when removable storage devices were connected to an endpoint. This information can support investigations involving unauthorized […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 141. Which telemetry can reveal unusual registry modifications? DNS response data Registry change events Network route tables Printer queue records Correct Answer: 2 Explanation: Registry change events can help hunters identify modifications to operating-system configuration and application settings. Attackers may alter registry locations […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 121. Which telemetry can expose unusual remote administration activity? Remote session logs Display brightness records Battery charging cycles Audio device settings Correct Answer: 1 Explanation: Remote session logs can provide valuable evidence when investigating unusual administrative access. They may identify the account used, […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 101. Which activity can help detect unusual service account behavior? Monitor configuration changes Review account activity Inspect display adapters Measure disk temperature Correct Answer: 2 Explanation: Reviewing account activity can help identify unusual behavior involving service accounts. Hunters can examine authentication times, source […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 81. Which method can uncover abnormal lateral movement between hosts? User-interface review Software licensing checks East-west traffic analysis Screen resolution testing Correct Answer: 3 Explanation: East-west traffic analysis examines communication between systems within an environment. This visibility can help identify unusual host-to-host connections […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 61. Which telemetry is most useful for identifying unusual parent-child process relationships? DNS query logs Process creation events Firewall rule sets Certificate inventories Correct Answer: 2 Explanation: Process creation events record which executable launched another process, creating a parent-child relationship. Threat hunters can […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps Question 41. Which security control helps detect unauthorized changes to critical files? Network segmentation File integrity monitoring Load balancing Address translation Correct Answer: 2 Explanation: File integrity monitoring detects changes to monitored files, directories, or configuration objects. It can identify modifications, creations, deletions, or other […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 21. Which technique helps hunters investigate suspicious PowerShell activity? Disk defragmentation Screen calibration Cable mapping Command-line analysis Correct Answer: 4 Explanation: Command-line analysis is valuable when investigating PowerShell activity because it can reveal the commands, parameters, scripts, and execution context used by a […]

View Full Cisco 300-220 Exam Dumps and Practice Test Dumps   Question 1. What does the Pyramid of Pain primarily measure in threat intelligence? Attacker difficulty Network bandwidth Malware size Log retention Correct Answer: 1 Explanation: The Pyramid of Pain represents the relative difficulty an adversary experiences when defenders detect and disrupt different types of […]

View Full PECB Lead Auditor Exam Dumps and Practice Test Dumps.   Question 381 What should an auditor verify when reviewing the competence records of audit team members? Whether every auditor has identical qualifications Whether competence is relevant to assigned audit responsibilities Whether records contain the highest number of certificates Whether all auditors have the […]

View Full PECB Lead Auditor Exam Dumps and Practice Test Dumps.   Question 361 What should an auditor verify when assessing whether audit objectives remain achievable during fieldwork? Whether all planned interviews have identical durations Whether the audit team has enough time and access to obtain evidence supporting the objectives Whether management agrees with every […]

View Full PECB Lead Auditor Exam Dumps and Practice Test Dumps.   Question 341 What should an auditor consider when determining whether audit evidence is sufficient? Whether the evidence is lengthy Whether management accepts it Whether enough relevant and reliable evidence supports the conclusion Whether the evidence comes from one department Correct Answer: 3 Explanation […]

View Full PECB Lead Auditor Exam Dumps and Practice Test Dumps.   Question 321 What should an auditor verify when reviewing the responsibilities assigned to process owners? Whether every employee has identical responsibilities Whether responsibilities are documented only in meeting minutes Whether responsibilities are clearly assigned and understood for relevant activities Whether process owners have […]

View Full PECB Lead Auditor Exam Dumps and Practice Test Dumps.   Question 301 What should an auditor consider when determining whether audit evidence is sufficient? The quantity, relevance, reliability, and relationship of evidence to the audit objective The number of pages collected The preference of the process owner The age of the audit team […]