CS0-003 Question #353: Real Exam Question with Answer & Explanation

Question

The SOC received a threat intelligence notification indicating that an employee's credentials were found on the dark web. The user's web and log-in activities were reviewed for malicious or anomalous connections, data uploads/downloads, and exploits. A review of the controls confirmed multifactor authentication was enabled. Which of the following should be done first to mitigate impact to the business networks and assets?

Options

• APerform a forced password reset.
• BCommunicate the compromised credentials to the user.
• CPerform an ad hoc AV scan on the user's laptop.
• DReview and ensure privileges assigned to the user's account reflect least privilege.
• ELower the thresholds for SOC alerting of suspected malicious activity