IISFA II0-001 Exam - Topic 6 Question 71 Discussion

Actual exam question for IISFA's II0-001 exam

Question #: 71
Topic #: 6

It has been determined that a system on your network has been compromised. What should you do on your IDS and firewalls as soon as possible?

AVerify a sniffer hasn't been installed on the compromised system

BVerify the IDS' & Firewalls haven't been compromised, as well

CReboot the IDS', firewalls and compromised systems for a clean startup

DVerify all systems are using the same NTP server - document any issues

Show Suggested Answer

Suggested Answer: D

by Terrilyn at Jul 09, 2023, 09:26 PM

Limited Time Offer

25%

Off

Get Premium II0-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tijuana

4 months ago

Agreed, verifying the IDS is crucial right away.

upvoted 0 times

...

Jess

4 months ago

Surprised that NTP sync is even a concern here!

upvoted 0 times

...

Casie

4 months ago

You should verify the IDS hasn't been compromised too.

upvoted 0 times

...

Sheridan

5 months ago

I think rebooting might just hide the problem.

upvoted 0 times

...

Nakita

5 months ago

Definitely check the IDS and firewalls first!

upvoted 0 times

...

Kristofer

5 months ago

I vaguely recall something about ensuring all systems are synced with the same NTP server, but I don't see how that relates to a compromise.

upvoted 0 times

...

Devora

5 months ago

I feel like rebooting everything might not be the best idea right away. We could lose valuable evidence, right?

upvoted 0 times

...

Latrice

5 months ago

I think we practiced a question where we had to check for sniffer installations on compromised systems. That might be important too.

upvoted 0 times

...

Horace

5 months ago

I remember we talked about verifying the integrity of the IDS and firewalls first, but I'm not sure if that's the best immediate step.

upvoted 0 times

...

Hyman

6 months ago

I'm a bit confused by this one. Isn't simplicity usually a good thing in app design? I'll have to re-read the question a few times.

upvoted 0 times

...

Christiane

6 months ago

This question seems straightforward, but I want to make sure I understand the key concepts before answering.

upvoted 0 times

...

Magnolia

6 months ago

Hmm, I'm a bit unsure about this one. I'll need to review the details on the different Azure service options and how they might meet the requirements.

upvoted 0 times

...

Quentin

6 months ago

I'm a bit confused on this one. Is the environment variable option something to consider, or is that not relevant to the problem at hand?

upvoted 0 times

...

Irving

6 months ago

This question seems straightforward, but I want to make sure I understand the context correctly before answering.

upvoted 0 times

...

Lashon

11 months ago

I'm going with B. Checking the IDS and firewalls is like locking the doors and windows before you start cleaning up a mess - gotta make sure the bad guys can't get back in!

upvoted 0 times

Aliza

9 months ago

User 3: I think verifying the IDS' & Firewalls is a smart first step to take.

upvoted 0 times

...

Rolf

10 months ago

User 2: Definitely, we need to make sure the bad guys can't sneak back in.

upvoted 0 times

...

Gwenn

10 months ago

User 1: I agree, checking the IDS and firewalls is crucial to prevent further compromise.

upvoted 0 times

...

Sunshine

11 months ago

B is the obvious choice. Gotta make sure the IDS and firewalls are secure before you can even think about anything else. Wouldn't want to miss the real culprit while chasing a red herring!

upvoted 0 times

...

Glory

11 months ago

Hmm, I'm not sure about D. Verifying NTP synchronization is important, but it's not the most pressing issue here. B seems like the way to go to me.

upvoted 0 times

Bernardine

10 months ago

User 3: Definitely, let's focus on securing our defenses first.

upvoted 0 times

...

Laticia

10 months ago

User 2: Agreed, that should be our first priority to make sure they haven't been compromised.

upvoted 0 times

...

Owen

10 months ago

User 1: I think we should go with option B and verify the IDS' & Firewalls.

upvoted 0 times

...

King

11 months ago

I'm leaning towards C. A clean reboot could help stop any ongoing malicious activity on the compromised system. Plus, it's better to be safe than sorry, right?

upvoted 0 times

Vicki

9 months ago

D) Verify all systems are using the same NTP server - document any issues

upvoted 0 times

...

Vallie

9 months ago

Let's go with C then. It seems like the safest option.

upvoted 0 times

...

Nobuko

9 months ago

C) Reboot the IDS', firewalls and compromised systems for a clean startup

upvoted 0 times

...

Nu

9 months ago

I would also go with C. It's better to be safe than sorry.

upvoted 0 times

...

Angella

9 months ago

I agree, a clean reboot could help prevent further damage.

upvoted 0 times

...

Chun

10 months ago

B) Verify the IDS' & Firewalls haven't been compromised, as well

upvoted 0 times

...

Lenny

10 months ago

I think C is a good choice. It's important to start fresh.

upvoted 0 times

...

Stephaine

10 months ago

A) Verify a sniffer hasn't been installed on the compromised system

upvoted 0 times

...

Asha

11 months ago

We should also check for any sniffers on the compromised system to prevent further data leakage.

upvoted 0 times

...

Delbert

11 months ago

Definitely go with option B. Checking the integrity of the IDS and firewalls is crucial before taking any other action. Can't have the watchdog getting compromised too!

upvoted 0 times