MENU
Data has been exfiltrated and advertised for sale on the dark web. A web server shows:
Database unresponsiveness
PageFile.sys changes
Disk usage spikes with CPU spikes
High page faults
Which action should the IR team perform on the server?
Suggested Answer: C
Get Premium 300-215 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The combination of CPU spikes, disk usage peaks, and fluctuating PageFile.sys indicates excessive virtual memory paging, which may be a sign of malicious memory or file access behavior. PageFile.sys is part of the virtual memory system, and analyzing it can reveal which processes or payloads are consuming unusual amounts of memory, especially during exfiltration events.
2 comments · newest first
MA
Marya
3 days ago
I'm not entirely sure, but I feel like checking the database.log file could help too, especially since the database is unresponsive.
LA
Laine
9 days ago
I remember we discussed how analyzing PageFile.sys can reveal a lot about memory usage and potential issues, so I think option C might be the right choice.