How are the following categorized? - Backdoor account access - Hijacked processes - Lateral movement - Port scanning

The correct answer is D. incidents. In Prisma Cloud Compute, these behaviors - backdoor account access, hijacked processes, lateral movement, and port scanning - are classified as Incidents. Incidents represent correlated, high-severity runtime security events detected by Defender that indicate active compromise or

Security Operations and Incident Response

Question

How are the following categorized?

Backdoor account access
Hijacked processes
Lateral movement
Port scanning

Options

Aaudits
Bmodels
Cadmission controllers
Dincidents

How the community answered

(21 responses)

A
5% (1)
C
10% (2)
D
86% (18)

Explanation

In Prisma Cloud Compute, these behaviors - backdoor account access, hijacked processes, lateral movement, and port scanning - are classified as Incidents. Incidents represent correlated, high-severity runtime security events detected by Defender that indicate active compromise or malicious activity. They are distinct from Audits (which are lower-level, individual runtime events) and from Models (which represent learned behavioral baselines). Admission controllers are Kubernetes enforcement mechanisms, not a classification category for security events.

Topics

#Attack Techniques#Cybersecurity Incidents#Threat Detection#Incident Response

Community Discussion

No community discussion yet for this question.

Full PCCSE Practice