CrowdStrike Falcon Cloud Security has detected anomalous behavior on a virtual machine (VM) running in a cloud environment. The following events were flagged: ?An outbound connection to…

Question

Options

• ARun an antivirus scan on the VM and delete any flagged files to remove potential malware.
• BImmediately isolate the VM, capture memory and disk snapshots for forensic analysis, and
• CModify the VM's firewall rules to block outgoing traffic and wait for additional alerts before taking
• DIgnore the alert, as the presence of kworker is normal in Linux environments and does not indicate

• A
  3% (2)
• B
  69% (41)
• C
  8% (5)
• D
  19% (11)

Explanation

Option A: Running an antivirus scan may detect malware, but it does not prevent ongoing attacker activity or preserve forensic evidence for deeper investigation. Option B: The combination of Tor connections, failed logins, base64 and netcat usage, and execution from /tmp suggests potential malware activity or an active attack. Isolating the VM prevents further compromise, while forensic analysis helps identify the root cause. Option C: Blocking outbound traffic may slow down attacker activities but does not fully prevent further actions or identify the existing compromise. Immediate isolation is more effective. Option D: While kworker is a normal Linux process, its execution from /tmp is highly suspicious, as /tmp is a common location for malware execution. Ignoring this alert is a security risk.

No community discussion yet for this question.