MENU
A security team detected an above-average amount of inbound tcp/135 connection attempts from unidentified senders. The security team is responding based on their incident response playbook. Which two elements are part of the eradication phase for this incident? (Choose two.)
Suggested Answer: A
Get Premium 300-215 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
34 comments · newest first
IR
Ira
11 months ago
Not sure about enterprise block listing being effective in this case.
NO
Novella
11 months ago
Agree, anti-malware is a must for eradication!
LE
Lenita
11 months ago
Surprised that centralized user management isn't included here.
HA
Hannah
11 months ago
I think intrusion prevention should be part of it too!
LE
Lewis
12 months ago
Definitely anti-malware software and data isolation.
RE
Rebecka
12 months ago
I’m leaning towards enterprise block listing as a way to prevent future connections, but I’m not entirely sure if it fits the eradication phase specifically.
BA
Barney
1 year ago
I practiced a similar question, and I feel like an intrusion prevention system might be more about detection than eradication.
LI
Linn
1 year ago
I think data and workload isolation is definitely part of the eradication phase. It makes sense to contain the threat before removing it.
LO
Long
1 year ago
I remember that the eradication phase is about removing the threat, but I'm not sure if anti-malware software is the best choice here.
HO
Howard
1 year ago
Enterprise block listing solution seems like it could be part of the eradication process too. Blocking the unidentified senders might help stop the connection attempts.
DA
Dalene
1 year ago
Okay, I've got a strategy. The eradication phase is about removing the threat, so I'll look for options that directly address the issue, like anti-malware software and intrusion prevention.
MA
Marion
1 year ago
Hmm, I'm a bit unsure about this one. The incident response playbook is mentioned, but I'm not totally clear on what the eradication phase entails. I'll have to think this through carefully.
FA
Fannie
1 year ago
This question seems straightforward. I'll focus on the "eradication phase" part and think about what that might involve.
TE
Teddy
1 year ago
Data and workload isolation seems like a good choice for eradication. Separating the affected systems from the rest of the network could help contain the issue. I'll mark that one down.
NI
Nidia
1 year ago
I bet the security team is wishing they had a solid firewall in place to block those TCP/135 connection attempts. Guess they'll have to settle for an IPS instead. *chuckles*
RU
Ruby
1 year ago
C: Hopefully they can isolate the data and workload to prevent any further attacks.
AN
An
1 year ago
B: Yeah, an IPS will have to do the job for now.
EL
Elliot
1 year ago
A: They definitely need a strong firewall to block those connection attempts.
MA
Martina
1 year ago
B and D, no doubt! Gotta isolate that infected data and use the IPS to block those pesky TCP/135 connection attempts. Easy peasy, lemon squeezy!
RI
Richelle
1 year ago
Hmm, this is a tricky one. I'm leaning towards B and D, but I'm also wondering if C might be relevant for the eradication phase. I'll have to think this through a bit more.
EL
Elza
1 year ago
I'm not sure about this one. I was thinking A and E might be the right answers, but I'm not confident. Guess I need to review my incident response playbook again.
DE
Delpha
1 year ago
You got it! Those are the two elements for the eradication phase.
MA
Matt
1 year ago
E) enterprise block listing solution
HY
Hyman
1 year ago
B) data and workload isolation
RO
Rosina
1 year ago
Those are the correct choices for the eradication phase. Good job!
CO
Cordie
1 year ago
D) intrusion prevention system
GE
Genevive
1 year ago
A) anti-malware software
LE
Leontine
1 year ago
I think the answer is B and D. Isolating the affected data and systems, and using an IPS to detect and prevent further intrusions sound like the right steps for the eradication phase.
TA
Tawny
1 year ago
It's important to follow the incident response playbook to ensure a thorough eradication process.
DO
Doyle
1 year ago
Using an IPS to detect and prevent further intrusions is also important to stop the attack.
KE
Kenneth
1 year ago
I agree, isolating the affected data and systems is crucial in the eradication phase.
DW
Dwight
2 years ago
I believe data and workload isolation is also crucial in the eradication phase to contain the threat.
BA
Barb
2 years ago
I agree with Rozella. We should also consider using intrusion prevention system for eradication.
RO
Rozella
2 years ago
I think we should use anti-malware software to eradicate the threat.