312-39V2: Certified SOC Analyst v2

Question

A leading e-commerce company uses backend servers to process customer transactions. As a SOC analyst working with its cybersecurity team, you observe a sharp rise in CPU utilization on one backend server one morning. The team scans and monitors the server and discovers an unknown process consuming excessive resources. Further forensic analysis identifies an unrecognized scheduled task that launches a PowerShell script connecting to an unknown IP address. What should you do to confirm whether this is an active attack?

Explanation

Network logs reveal whether the PowerShell script is establishing suspicious external communications, such as an ongoing connection to an unknown command-and-control endpoint. This directly helps confirm active malicious activity.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ77

Community Discussion