Palo Alto Networks PCCET Exam - Topic 7 Question 69 Discussion

Actual exam question for Palo Alto Networks's PCCET exam

Question #: 69
Topic #: 7

[All PCCET Questions]

Which action must Secunty Operations take when dealing with a known attack?

ADocument, monitor, and track the incident.

BLimit the scope of who knows about the incident.

CIncrease the granularity of the application firewall.

DDisclose details of lhe attack in accordance with regulatory standards.

Show Suggested Answer

Suggested Answer: A

Security Operations (SecOps) is the process of coordinating and aligning security teams and IT teams to improve the security posture of an organization. SecOps involves implementing and maintaining security controls, technologies, policies, and procedures to protect the organization from cyber threats and incidents. When dealing with a known attack, SecOps must take the following action: document, monitor, and track the incident. This action is important because it helps SecOps to:

* Record the details of the attack, such as the source, target, impact, timeline, and response actions.

* Monitor the status and progress of the incident response and recovery efforts, as well as the ongoing threat activity and indicators of compromise.

* Track the performance and effectiveness of the security controls and technologies, as well as the lessons learned and improvement opportunities. Reference:

* Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)

* 6 Incident Response Steps to Take After a Security Event - Exabeam

* Dealing with Cyber Attacks--Steps You Need to Know | NIST

by Markus at Sep 18, 2024, 06:26 AM

Limited Time Offer

25%

Off

Get Premium PCCET Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Golda

3 months ago

Really? I thought increasing firewall granularity was key.

upvoted 0 times

...

Paola

3 months ago

I think B could backfire, we need transparency.

upvoted 0 times

...

Vivienne

3 months ago

Wait, isn't limiting info risky?

upvoted 0 times

...

Filiberto

4 months ago

Totally agree, A is the way to go.

upvoted 0 times

...

Fernanda

4 months ago

Gotta document and track everything during an attack!

upvoted 0 times

...

Chauncey

4 months ago

I’m torn between A and D. I know regulatory standards are important, but I feel like documenting the incident is more critical in the moment.

upvoted 0 times

...

Tawanna

4 months ago

I practiced a question similar to this, and I think the focus was on tracking incidents. So, A seems like the best choice to me.

upvoted 0 times

...

Leonida

4 months ago

I feel like B could also be a valid option, especially if we want to limit panic among the staff. But I can't recall if that's the main priority during an attack.

upvoted 0 times

...

Derick

5 months ago

I think the right answer might be A, but I'm not entirely sure. I remember we discussed the importance of documentation in class.

upvoted 0 times

...

Kenny

5 months ago

Based on my understanding of incident response best practices, I think the right answer is to document, monitor, and track the incident. Option A seems like the way to go.

upvoted 0 times

...

Laurel

5 months ago

I'm a bit confused by the wording of the question. I'll need to re-read it a few times to make sure I understand what they're asking.

upvoted 0 times

...

Tyra

5 months ago

Okay, let's see. The key here is to document and track the incident, so I'm leaning towards option A.

upvoted 0 times

...

German

5 months ago

Hmm, I'm a bit unsure about this. I'll need to think through the different options carefully.

upvoted 0 times

...

Milly

5 months ago

This seems like a straightforward incident response question. I'm pretty confident I can handle this one.

upvoted 0 times

...

Gail

5 months ago

Okay, I think I know how to approach this. The higher the frequency, the higher the space loss, so the 15 GHz link should have more space loss than the 7 GHz link. I'll need to do the calculations to find the difference.

upvoted 0 times

...

Pearlie

1 year ago

Hmm, I'd go with A. Documenting the incident is like writing your memoirs - you never know when you'll need to refer back to it.

upvoted 0 times

Brandee

1 year ago

User 3: Definitely, documentation is key in handling known attacks.

upvoted 0 times

...

Eura

1 year ago

User 2: Eura is right, it's important to keep a record of everything.

upvoted 0 times

...

Bulah

1 year ago

A) Document, monitor, and track the incident.

upvoted 0 times

...

Marleen

1 year ago

D) Disclosing attack details? What is this, a gossip session? Security ops should keep a tight lid on sensitive information.

upvoted 0 times

...

Salena

1 year ago

C) Increasing the granularity of the application firewall? Sounds like a job for the IT crew, not security ops. But I guess it could help mitigate the attack.

upvoted 0 times