Decision making is a principle that guides an analyst to gather information relevant to a security incident to determine the appropriate course of action. Decision making involves identifying the problem, defining the criteria, analyzing the alternatives, and choosing the best solution. Decision making helps an analyst to respond to an incident effectively and efficiently, while minimizing the impact and risk to the organization. Reference: https://learningnetworkstore.cisco.com/on-demand e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1.0/CSCU-LP CBROPS-V1-028093.html (Module 3: Security Monitoring, Lesson 3.1: Security Operations Center)

Attacking a vulnerability is categorized as exploitation, which is the third phase of the cyberattack lifecycle. Exploitation is the process of taking advantage of a vulnerability in a system, application, or network to gain access, escalate privileges, or execute commands. Action on objectives, delivery, and installation are other phases of the cyberattack lifecycle, but they do not involve attacking a vulnerability. Action on objectives is the final phase, where the attacker achieves their goal, such as stealing data, disrupting services, or destroying assets. Delivery is the second phase, where the attacker delivers the malicious payload, such as malware, phishing email, or malicious link, to the target. Installation is the fourth phase, where the attacker installs the malicious payload on the compromised system or network to maintain persistence or spread laterally. Reference: What is a Cyberattack? | IBM, Recognizing the seven stages of a cyber-attack - DNV

Separation of duties is a security principle that requires more than one person to perform a critical task, such as authorizing a transaction, approving a budget, or granting access to sensitive data. Separation of duties reduces the risk of fraud, error, abuse, or conflict of interest by preventing any single person from having too much power or privilege. Least privilege, need to know, and due diligence are other security principles, but they do not require more than one person to perform a critical task. Reference: Separation of Duty (SOD) - Glossary | CSRC - NIST Computer Security …, Separation of Duties | Imperva

User interaction is any event that requires the user to perform an action that enables or facilitates a cyberattack. Opening a malicious file is an example of user interaction, as it can trigger the execution of malicious code or malware that can compromise the system or network. Gaining root access, executing remote code, and reading and writing file permissions are not user interactions, but rather actions that can be performed by an attacker after exploiting a vulnerability or bypassing security controls. Reference: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) Cisco, More than 99% of cyberattacks rely on human interaction 

Ping of Death involves sending oversized or malformed pings to crash the target system, while UDP flooding overwhelms the target with UDP packets to consume its resources and disrupt services. These are both examples of denial of service attacks, which aim to prevent legitimate users from accessing a system or service. References := Cisco Cybersecurity Operations Fundamentals - Module 4: Network Intrusion Analysis

The 5-tuple refers to the five different values that are used to define a specific communication session in a network. These values include the source IP address, destination IP address, source port, destination port, and the protocol in use. In this case, option D (Source Port) and option E (Initiator IP) are parts of the 5-tuple. References := Cisco Cybersecurity Operations Fundamentals

Full packet capture requires the largest amount of storage space because it involves recording all packets that pass through a network, including all headers and payloads. This type of data collection is comprehensive and allows for detailed analysis, but due to the volume of data it encompasses, it demands significant storage capacity1.

References := The Cisco Secure Network Analytics Data Store Design Guide discusses the storage requirements for different types of network data collection, highlighting the substantial storage needs for full packet captures1.

Running all processes as root or administrator violates the principle of least privilege, which states that users and processes should be granted only the minimum permissions necessary to perform their specific role or function within an organization. Running all processes as root or administrator gives them full access and control over the system, which increases the risk of unauthorized actions, malicious attacks, and accidental errors. It also makes it easier for attackers to escalate their privileges and compromise the system. References:

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 1: Security Concepts, Lesson 1.2: Security Principles

Cisco Certified CyberOps Associate Overview, Exam Topics, 1.1 Explain the CIA triad