300-215 · Question #70
Refer to the exhibit. A security analyst is reviewing alerts from the SIEM system that was just implemented and notices a possible indication of an attack because the SSHD system just went live and…
The correct answer is A. Investigate the alert by checking SSH logs and correlating with other relevant data in SIEM. The first step is to validate the alert and gather context-review SSHD’s detailed logs (e.g., /var/log/auth.log), look for related login attempts or unusual patterns, and correlate with firewall or endpoint data. This confirms whether it’s a false positive or an active…
Question
Refer to the exhibit. A security analyst is reviewing alerts from the SIEM system that was just implemented and notices a possible indication of an attack because the SSHD system just went live and there should be nobody using it. Which action should the analyst take to respond to the alert?
Options
- AInvestigate the alert by checking SSH logs and correlating with other relevant data in SIEM.
- BReset the admin password in SSHD to prevent unauthorized access to the system at scale.
- CIgnore the alert and continue monitoring for further activity because the system was just
- DImmediately block the IP address 192.168.1.100 from accessing the SSHD environment.
How the community answered
(39 responses)- A79% (31)
- B5% (2)
- C3% (1)
- D13% (5)
Explanation
The first step is to validate the alert and gather context-review SSHD’s detailed logs (e.g., /var/log/auth.log), look for related login attempts or unusual patterns, and correlate with firewall or endpoint data. This confirms whether it’s a false positive or an active brute-force attempt before taking containment actions.
Topics
Community Discussion
No community discussion yet for this question.