Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Free Preparation Discussions
MENU
CompTIA Exam CAS-004 Topic 10 Question 47 Discussion
Actual exam question for
CompTIA's
CAS-004 exam
Question #: 47
Topic #: 10
[All CAS-004 Questions]
Topic #: 10
A SOC analyst received an alert about a potential compromise and is reviewing the following SIEM logs:
Which of the following is the most appropriate action for the SOC analyst to recommend?
Suggested Answer:
B
The SIEM logs indicate suspicious behavior that could be a sign of a compromise, such as the launching of cmd.exe after Outlook.exe, which is atypical user behavior and could indicate that a machine has been compromised to perform lateral movement within the network. Isolating laptop314 from the network would contain the threat and prevent any potential spread to other systems while further investigation takes place.
Nina
12 months agoBambi
1 years agoJosphine
1 years agoCarma
1 years agoEdelmira
1 years agoNobuko
1 years agoIsaiah
1 years agoGianna
1 years agoBok
1 years agoXochitl
1 years agoArmando
1 years agoSanjuana
1 years agoVallie
1 years agoKanisha
1 years agoIzetta
1 years agoMelita
1 years agoGrover
1 years agoRaina
1 years agoHobert
1 years agoRonald
1 years agoChau
1 years agoFallon
1 years agoChaya
1 years agoBea
1 years agoRosendo
1 years ago