Multiple Choice
A security is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS. Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise?
A) Run an anti-malware scan on the system to detect and eradicate the current threat
B) Start a network capture on the system to look into the DNS requests to validate command and control traffic
C) Shut down the system to prevent further degradation of the company network
D) Reimage the machine to remove the threat completely and get back to a normal running state
E) Isolate the system on the network to ensure it cannot access other systems while evaluation is underway
Correct Answer:
Verified
Correct Answer:
Verified
Q51: A security analyst reviews the following aggregated
Q52: A security analyst is reviewing the logs
Q53: The inability to do remote updates of
Q54: A forensic analyst took an image of
Q55: A security analyst is reviewing packet captures
Q57: An organization that handles sensitive financial information
Q58: A large software company wants to move
Q59: Which of the following will allow different
Q60: An organization has not had an incident
Q61: During an investigation, an analyst discovers the