300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity

Question

An employee receives an email from a "trusted" person that contains a hyperlink involving malvertising. The employee clicks the link, and malware is downloaded. An information analyst notices an alert in the SIEM and engages the cybersecurity team to analyze the incident according to the incident response plan. Which event detail should be included in this root cause analysis?

Explanation

A root cause analysis records the initiating event that enabled the incident. The phishing email containing the malicious hyperlink led to the employee’s click and subsequent malware download; SIEM alarms and team alerts are detection events rather than the underlying cause.

300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity

AstroTutor

Notes

Readiness

QuestionQ2

Community Discussion