An analyst reviews a SIEM and generates the following report: Only HOST002 is authorized for internet traffic. Which of the following statements is accurate?

Question

Exhibits

Options

• AThe VM002 host is misconfigured and needs to be revised by the network team.
• BThe HOST002 host is under attack, and a security incident should be declared.
• CThe SIEM platform is reporting multiple false positives on the alerts.
• DThe network connection activity is unusual, and a network infection is highly possible.

• A
  3% (1)
• B
  3% (1)
• C
  90% (36)
• D
  5% (2)

Explanation

The activity seen aligns with authorized/expected behavior (HOST002 going external, VM002 staying internal). The “offenses” generated are not actual threats.

No community discussion yet for this question.