350-201 · Question #81
A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process a
Sign in or unlock 350-201 to reveal the answer and full explanation for question #81. The question stem and answer options stay visible for context.
Question
A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process and a WMI tool process were started on the server after the connection was established and that a PE format file was created in the system directory. What is the next step the analyst should take?
Options
- AIsolate the server and perform forensic analysis of the file to determine the type and vector of a
- BIdentify the server owner through the CMDB and contact the owner to determine if these were
- CReview the server backup and identify server content and data criticality to assess the intrusion
- DPerform behavioral analysis of the processes on an isolated workstation and perform cleaning
Unlock 350-201 to see the answer
You've previewed enough free 350-201 questions. Unlock 350-201 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.