Free Preparation Discussions
MENU
CompTIA CS0-003 Exam - Topic 2 Question 48 Discussion
Topic #: 2
A security analyst has received an incident case regarding malware spreading out of control on a customer's network. The analyst is unsure how to respond. The configured EDR has automatically obtained a sample of the malware and its signature. Which of the following should the analyst perform next to determine the type of malware, based on its telemetry?
The signature of the malware is a unique identifier that can be used to compare it with known malware samples and their behaviors. Open-source threat intelligence sources provide information on various types of malware, their indicators of compromise, and their mitigation strategies. By cross-referencing the signature with these sources, the analyst can determine the type of malware and its telemetry. The other options are not relevant for this purpose: configuring the EDR to perform a full scan may not provide additional information on the malware type; transferring the malware to a sandbox environment may expose the analyst to further risks; logging in to the affected systems and running netstat may not reveal the malware activity.
Izetta
2 months agoBerry
2 months agoShizue
2 months agoIlene
2 months agoJaney
3 months agoPete
3 months agoDarrin
4 months agoFrancoise
4 months agoCarey
4 months agoShawna
4 months agoRyan
4 months agoCelestine
5 months agoAndrew
5 months agoRaul
5 months agoLeonora
5 months agoMargo
5 months agoDana
2 months agoLeota
2 months agoCarline
3 months agoDevorah
3 months agoAmber
6 months agoSage
5 months agoJovita
6 months agoRomana
5 months agoJosephine
5 months agoReita
5 months ago