300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

By Cisco · Question Mode

QuestionQ74

Incident Response Techniques

Question Image

Refer to the exhibit. A security analyst is reviewing alerts from the newly implemented SIEM system and observes a possible attack indicator because the SSHD system has just gone live and no one should be using it. What action should the analyst take in response to this alert?

  • A Investigate the alert by checking SSH logs and correlating with other relevant data in SIEM.
  • B Reset the admin password in SSHD to prevent unauthorized access to the system at scale.
  • C Ignore the alert and continue monitoring for further activity because the system was just implemented.
  • D Immediately block the IP address 192.168.1.100 from accessing the SSHD environment./p>.
Explanation

A failed SSH login using an invalid account is a potential indicator of unauthorized access, but it requires validation before containment. Reviewing SSH logs and correlating the event with other SIEM data establishes whether the attempt is isolated, part of a broader attack, or caused by a legitimate configuration issue.

Community Discussion

No comments yet. Be the first to start the discussion!