Cisco 350-201 Exam - Topic 9 Question 29 Discussion

Question

A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process and a WMI tool process were started on the server after the connection was established and that a PE format file was created in the system directory. What is the next step the analyst should take?

Amber · Accepted Answer

C) Review the server backup and identify server content and data criticality to assess the intrusion risk

Amber · Answer

A) Isolate the server and perform forensic analysis of the file to determine the type and vector of a possible attack

Amber · Answer

B) Identify the server owner through the CMDB and contact the owner to determine if these were planned and identifiable activities

Amber · Answer

D) Perform behavioral analysis of the processes on an isolated workstation and perform cleaning procedures if the file is malicious