MENU
An information security team has identified traffic from a device to a known malicious IP. Which of the following should be the team's FIRST course of action to address this issue?
Suggested Answer: D
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
15 comments · newest first
AJ
Aja
11 months ago
Re-imaging sounds extreme for just traffic to a malicious IP.
DY
Dyan
12 months ago
Wait, is turning off the device really the best move?
LE
Leoma
12 months ago
Definitely agree with disconnecting it!
EV
Evan
12 months ago
I think running anti-malware first makes more sense.
LA
Launa
1 year ago
Disconnect the device from the network ASAP!
NA
Na
1 year ago
I feel like re-imaging the device is too drastic as a first step. We should assess the situation before taking such action.
HA
Harris
1 year ago
I'm torn between turning off the device and running anti-malware. I feel like both could be valid, but I lean towards disconnecting first.
CA
Cassie
1 year ago
I remember a practice question where we had to prioritize actions, and disconnecting seemed like the safest option.
NO
Novella
1 year ago
I think the first step should be to disconnect the device from the network to prevent further damage, but I'm not entirely sure.
AD
Adelaide
1 year ago
Okay, the key information is that the village is located on an island. I'll eliminate the options that don't mention an island and go from there.
DE
Deandrea
1 year ago
Hmm, this is a bit tricky with all the different user permissions required. I'll need to be really careful to get the chown, chmod, and setfacl commands right. And I'll have to make sure I create the new user bob with the correct UID.
CO
Corazon
1 year ago
I think the key here is to focus on the ACLs. The question is asking what action resolves the issue, so it's probably something to do with the firewall rules. I'd start by looking at the outbound ACL and see if I need to allow the 10.66.46.0/23 subnet or DNS traffic.
MA
Maryann
1 year ago
I've got a good feeling about this one. JMS and JCA are the two Java EE technologies that are designed for integrating with external systems, so those are the obvious choices. I'm confident those are the right answers.
KR
Kristel
1 year ago
I think the best approach here is to look at the correlations between the variables and only keep the ones that are not highly correlated. That way we can reduce the dimensionality without losing too much information.
TR
Tracey
1 year ago
Hmm, this seems like a tricky one. I'll need to think through the NETCONF operations carefully to figure out which one is specific to session notifications.