A security analyst reviews the daily logs and notices the following suspicious activity: The analyst investigates the firewall logs and identities the following: Which of the following steps should…

Question

Exhibits

Options

• ASubmit an IT support ticket and request Kali Linux be uninstalled from John Smith's computer
• BBlock all inbound connections on port 4444 and block the IP address 201.101.25.121.
• CContact John Smith and request the Ethernet cable attached to the desktop be unplugged
• DCheck the running processes to confirm if a backdoor connection has been established.
• EUpgrade the Windows x64 operating system on John Smith's computer to the latest version.
• FBlock all outbound connections from the IP address 10.150.71.151.

• A
  14% (5)
• B
  74% (26)
• E
  9% (3)
• F
  3% (1)

Explanation

Given the suspicious activity and Kali Linux's association with penetration testing and hacking tools, the security analyst should block all inbound connections on port 4444, as it is commonly used for malicious purposes, and block the IP address that's potentially the source of the intrusion. Additionally, checking the running processes on John Smith's computer is crucial to determine if a backdoor or unauthorized connection has been established.

No community discussion yet for this question.