Refer to the exhibit.

A security analyst needs to investigate a security incident involving several suspicious connections with a possible attacker. Which tool should the analyst use to identify the source IP of the offender?

1. A. packet sniffer
2. B. malware analysis
3. C. SIEM
4. D. firewall manager

Correct Answer: A

An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)

1. A. domain belongs to a competitor
2. B. log in during non-working hours
3. C. email forwarding to an external domain
4. D. log in from a first-seen country
5. E. increased number of sent mails

Correct Answer: AB

A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process and a WMI tool process were started on the server after the connection was established and that a PE format file was created in the system directory. What is the next step the analyst should take?

1. A. Isolate the server and perform forensic analysis of the file to determine the type and vector of a possible attack
2. B. Identify the server owner through the CMDB and contact the owner to determine if these were planned and identifiable activities
3. C. Review the server backup and identify server content and data criticality to assess the intrusion risk
4. D. Perform behavioral analysis of the processes on an isolated workstation and perform cleaning procedures if the file is malicious

Correct Answer: C

An organization lost connectivity to critical servers, and users cannot access business applications and internal websites. An engineer checks the network devices to investigate the outage and determines that all devices are functioning. Drag and drop the steps from the left into the sequence on the right to continue investigating this issue. Not all options are used.

Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A