During the triage of a SIEM alarm, a security analyst identifies the following activity on a .bash_history file: Which of the following actions should the analyst take?

The correct answer is A. Declare an incident and look for data exfiltration. The Bash history shows a small Python script being written that reads “secretsauce.txt,” retrieves each entry via HTTP, and then POSTS the retrieved content to an external server. Finally, the script is marked executable and run. This is a clear attempt to siphon sensitive data…

Submitted by omar99· Mar 6, 2026Incident Response and Management

Question

During the triage of a SIEM alarm, a security analyst identifies the following activity on a .bash_history file:

Which of the following actions should the analyst take?

Exhibit

Options

ADeclare an incident and look for data exfiltration.
BDeclare an incident and look for lateral movements.
CDeclare a false positive and close the alarm.
DDeclare an incident and look for malware in the affected machine.

How the community answered

(36 responses)

A
64% (23)
B
6% (2)
C
22% (8)
D
8% (3)

Explanation

The Bash history shows a small Python script being written that reads “secretsauce.txt,” retrieves each entry via HTTP, and then POSTS the retrieved content to an external server. Finally, the script is marked executable and run. This is a clear attempt to siphon sensitive data off‑host, so you should treat it as a confirmed incident and investigate what data has been exfiltrated.

Topics

#SIEM triage#bash history#data exfiltration#incident response

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice