QUESTION: 21

What is the goal of an incident response plan?

to identify critical systems and resources in an organization
to ensure systems are in place to prevent an attack
to determine security weaknesses and recommend solutions
to contain an attack and prevent it from spreading

Answer(s): D

Reference:

https://www.forcepoint.com/cyber-edu/incident-response

A security team received an alert of suspicious activity on a user’s Internet browser. The user’s anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)

Evaluate the process activity in Cisco Umbrella.
Analyze the TCP/IP Streams in Cisco Secure Malware Analytics (Threat Grid).
Evaluate the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid).
Analyze the Magic File type in Cisco Umbrella.
Network Exit Localization in Cisco Secure Malware Analytics (Threat Grid).

Answer(s): B,C

Reveal Solution Next Question

QUESTION: 23

An employee receives an email from a “trusted” person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis?