300-215 · Question #5
An employee receives an email from a "trusted" person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at…
The correct answer is A. phishing email sent to the victim. The root cause analysis in incident response focuses on identifying the initial trigger or root cause of the incident to understand how it started and how to prevent recurrence. In this scenario, the phishing email sent to the victim (A) is the initial trigger that led to the…
Question
An employee receives an email from a “trusted” person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis?
Options
- Aphishing email sent to the victim
- Balarm raised by the SIEM
- Cinformation from the email header
- Dalert identified by the cybersecurity team
How the community answered
(26 responses)- A73% (19)
- B15% (4)
- C8% (2)
- D4% (1)
Explanation
The root cause analysis in incident response focuses on identifying the initial trigger or root cause of the incident to understand how it started and how to prevent recurrence. In this scenario, the phishing email sent to the victim (A) is the initial trigger that led to the employee's action of clicking the malvertising link, resulting in the malware download. The other options represent later stages in the incident response cycle, such as detection (SIEM alert, cybersecurity team's alert) or supporting evidence (email header information), but they do not address the root cause, which is the phishing email itself.
Topics
Community Discussion
No community discussion yet for this question.