A security analyst notices a number of SIEM events that show the following activity: Which of the following response actions should the analyst take FIRST?

QuestionsCategory: CAS-004A security analyst notices a number of SIEM events that show the following activity: Which of the following response actions should the analyst take FIRST?
Admin Staff asked 6 months ago
A security analyst notices a number of SIEM events that show the following activity:
 Image
Which of the following response actions should the analyst take FIRST?

A. Disable powershell.exe on all Microsoft Windows endpoints.

B. Restart Microsoft Windows Defender.

C. Configure the forward proxy to block 40.90.23.154.

D. Disable local administrator privileges on the endpoints.








 

Suggested Answer: A

Community Answer: C



This question is in CAS-004 CompTIA Advanced Security Practitioner (CASP+) Exam
For getting CompTIA Advanced Security Practitioner (CASP+) Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by CompTIA. 
Trademarks, certification & product names are used for reference only and belong to CompTIA.
The website does not contain actual questions and answers from CompTIA's Certification Exams.

Next Post

Recommended

Welcome Back!

Login to your account below

Create New Account!

Fill the forms below to register

Retrieve your password

Please enter your username or email address to reset your password.