300-215 Question #65: Real Exam Question with Answer & Explanation

Question

A cybersecurity analyst is examining a complex dataset of threat intelligence information from various sources. Among the data, they notice multiple instances of domain name resolution requests to suspicious domains known for hosting C2 servers. Simultaneously, the intrusion detection system logs indicate a series of network anomalies, including unusual port scans and attempts to exploit known vulnerabilities. The internal logs also reveal a sudden increase in outbound network traffic from a specific internal host to an external IP address located in a high- risk region. Which action should be prioritized by the organization?

Options

• AThreat intelligence information should be marked as false positive because unnecessary alerts
• BFocus should be applied toward attempts of known vulnerability exploitation because the attacker
• COrganization should focus on C2 communication attempts and the sudden increase in outbound
• DData on ports being scanned should be collected and SSL decryption on Firewall enabled to