When reviewing the system logs, the cybersecurity analyst noticed a suspicious log entry: wmic /node: HRDepartment1 computersystem get username
Which of the following combinations describes what occurred, and what action should be taken in this situation?

A. A rogue user has queried for users logged in remotely. Disable local access to network shares.

B. A rogue user has queried for the administrator logged into the system. Attempt to determine who executed the command.

C. A rogue user has queried for the administrator logged into the system. Disable local access to use cmd prompt.

D. A rogue user has queried for users logged into in remotely. Attempt to determine who executed the command.








 

Suggested Answer: D





This question is in CS0-001 CompTIA Cybersecurity Analyst (CySA+) Exam
For getting CompTIA Cybersecurity Analyst (CySA+) Certificate



Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by CompTIA. 
Trademarks, certification & product names are used for reference only and belong to CompTIA.
The website does not contain actual questions and answers from CompTIA's Certification Exams.