MENU
An incident response team investigated a database breach, and determined it was likely the result of an internal user who had a default password in place. The password was changed. A week later, they discover another loss of database records. The database admin provides logs that indicate the attack came from the front-end web interface. Where did the incident response team fail?
Suggested Answer: D
Get Premium GCED Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
6 comments · newest first
WI
Wilbert
I think they should have locked the account after changing the password.
RI
Rickie
5 days ago
They definitely missed identifying the source of the breach.
MA
Mattie
10 days ago
I wonder if they overlooked patching the database server. I recall a practice question where not patching led to vulnerabilities being exploited again.
CA
Cassie
15 days ago
I feel like they should have locked the account after changing the password. That seems like a basic step that could have prevented further access.
FI
Filiberto
20 days ago
I'm not entirely sure, but I remember something about eradicating tools left behind by attackers being crucial. Maybe they didn't do that?
MY
Myra
26 days ago
I think the team might have failed to properly identify the source of the breach. It seems like they focused too much on the internal user and missed the web interface attack.