ExamTopics Logo
Mail Us[email protected]
Menu
Servicenow Discussions
exam questions

Exam CIS-SIR All Questions

View all questions & answers for the CIS-SIR exam
Go to Exam

Exam CIS-SIR topic 1 question 28 discussion

Actual exam question from ServiceNow's CIS-SIR
Question #: 28
Topic #: 1
[All CIS-SIR Questions]

When the Security Phishing Email record is created what types of observables are stored in the record? (Choose three.)

  • A. URLs, domains, or IP addresses appearing in the body
  • B. Who reported the phishing attempt
  • C. State of the phishing email
  • D. IP addresses from the header
  • E. Hashes and/or file names found in the EML attachment
  • F. Type of Ingestion Rule used to identify this email as a phishing attempt
Show Suggested Answer Hide Answer
Suggested Answer: ADE 🗳️
by sephereth at July 11, 2023, 2:29 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
MrBravo
9 months, 1 week ago
Selected Answer: ADE
Vancouver p. 334 IP addresses from the header URLs, domains, or IP addresses appearing in the body Hashes found in the EML attachment File names foind in the EML attachment
upvoted 1 times
...
Sazeka
1 year ago
Selected Answer: ADE
According to the ebook of Security Incident Response ( Tokyo ) p.98, Observables stateful properties: E-Observed MD5 hashes (e) A- Observed IP address (a) D- Observed email addresses (d)
upvoted 2 times
...
sephereth
1 year, 3 months ago
Selected Answer: ADE
Explanation: ebook p.98, Observables stateful properties: - Observed MD5 hashes (e) - Observed IP address (a) - Observed DNS names (a) - Observed email addresses (d)
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago