312-39V2: Certified SOC Analyst v2Demo

Question

A major financial institution enforces strict policies against unauthorized data transfers. As a SOC analyst performing routine log analysis, you detect an anomaly: an employee’s workstation is initiating large file transfers outside business hours. The files involved contain highly sensitive customer financial records. Further investigation shows that the employee has been remotely accessing the system from an unfamiliar IP address. Security logs also identify an unauthorized USB device connected to the workstation, in violation of corporate policy. Given the nature of the data and the potential for data exfiltration, you must act quickly. What should be your first step in responding to this incident?

A Isolate employee’s workstation and revoke remote access
B Conduct a full forensic analysis first
C Inform employee's department and wait for evidence
D Disable corporate VPN entirely

Explanation

Suspected active exfiltration of sensitive records requires immediate, targeted containment. Isolating the affected workstation stops its network communications and prevents further transfer or spread, while revoking remote access blocks the suspicious access path. CISA guidance likewise directs organizations to immediately isolate affected systems before collecting evidence and conducting detailed forensic analysis.

Learn more

CISA: Iranian Government-Sponsored APT Actors Compromise Federal Network

312-39V2: Certified SOC Analyst v2Demo

AstroTutor

Notes

Readiness

QuestionQ27

Community Discussion