QUESTION: 9

During their shift, an analyst receives an alert about an executable being run from
C:\Windows\Temp.
Why should this be investigated further?

Temp directories aren't owned by any particular user, making it difficult to track the process owner when files are executed.
Temp directories are flagged as non-executable, meaning that no files stored within can be executed, and this executable was run from that directory.
Temp directories contain the system page file and the virtual memory file, meaning the attacker can use their malware to read the in memory values of running programs.
Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.

Answer(s): D

Reveal Solution Next Question

QUESTION: 10

An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review.
Where would they find this?

Running the Risk Analysis Adaptive Response action within the Notable Event.
Via a workflow action for the Risk Investigation dashboard.
Via the Risk Analysis dashboard under the Security Intelligence tab in Enterprise Security.
Clicking the risk event count to open the Risk Event Timeline.

Answer(s): D

Reveal Solution Next Question

A Risk Rule generates events on Suspicious Cloud Share Activity and regularly contributes to confirmed incidents from Risk Notables. An analyst realizes the raw logs these events are generated from contain information which helps them determine what might be malicious.

What should they ask their engineer for to make their analysis easier?