CAS-003 · Question #400
An organization has recently deployed an EDR solution across its laptops, desktops, and server infrastructure. The organization's server infrastructure is deployed in an IaaS environment. A database…
The correct answer is A. Contain the server. F. Perform an IOC sweep to determine the impact. “The legal hold is initiated by a notice or communication from legal counsel to an organization that suspends the normal disposition or processing of records”. The question asks what the ‘Security Responder’ should do. Clearly he needs to first contain the server A, and then…
Question
An organization has recently deployed an EDR solution across its laptops, desktops, and server infrastructure. The organization's server infrastructure is deployed in an IaaS environment. A database within the non-production environment has been misconfigured with a routable IP and is communicating with a command and control server. Which of the following procedures should the security responder apply to the situation? (Choose two.)
Options
- AContain the server.
- BInitiate a legal hold.
- CPerform a risk assessment.
- DDetermine the data handling standard.
- EDisclose the breach to customers.
- FPerform an IOC sweep to determine the impact.
How the community answered
(38 responses)- A68% (26)
- B3% (1)
- C18% (7)
- D8% (3)
- E3% (1)
Explanation
“The legal hold is initiated by a notice or communication from legal counsel to an organization that suspends the normal disposition or processing of records”. The question asks what the ‘Security Responder’ should do. Clearly he needs to first contain the server A, and then perform an IOC
Topics
Community Discussion
No community discussion yet for this question.