Multiple Choice
A security administrator receives alerts from the perimeter UTM. Upon checking the logs, the administrator finds the following output: Time: 12/25 0300 From Zone: Untrust To Zone: DMZ Attacker: externalip.com Victim: 172.16.0.20 To Port: 80 Action: Alert Severity: Critical When examining the PCAP associated with the event, the security administrator finds the following information: <script> alert ("Click here for important information regarding your account! http://externalip.com/account.php ") ; </script> Which of the following actions should the security administrator take?
A) Upload the PCAP to the IDS in order to generate a blocking signature to block the traffic.
B) Manually copy the <script> data from the PCAP file and generate a blocking signature in the HIDS to block the traffic for future events. Manually copy the <script> data from the PCAP file and generate a blocking signature in the HIDS to block the traffic for future events.
C) Implement a host-based firewall rule to block future events of this type from occurring.
D) Submit a change request to modify the XSS vulnerability signature to TCP reset on future attempts.
Correct Answer:
Verified
Correct Answer:
Verified
Q994: A company wants to implement an access
Q995: A security administrator wishes to implement a
Q996: An organization's policy requires users to create
Q997: A systems administrator needs to integrate multiple
Q998: A corporation is concerned that, if a
Q1000: An organization requires secure configuration baselines for
Q1001: Which of the following provides the ability
Q1002: During a lessons learned meeting regarding a
Q1003: The IT department needs to prevent users
Q1004: Which of the following would allow for