312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

During a late-evening review at a financial services firm, analysts suspect sensitive files are being moved off the network through a built-in file-transfer client on a compromised workstation. The team requires a centralized, non-intrusive method to reveal this activity for initial triage without directly interacting with the endpoint.

Which monitoring action best supports detection of this activity?

A Capturing live packet data directly from the suspect host
B Monitoring aggregate FTP data transfer volumes through a SIEM platform
C Blocking outbound FTP connections at the firewall
D Reviewing endpoint file access logs on the affected workstation

Explanation

Monitoring aggregate FTP transfer volumes in a SIEM provides centralized visibility into network activity and can reveal abnormally large transfers or unusual communication volume without directly accessing the workstation. Firewall and flow logs are suitable sources for detecting suspicious transfer patterns during threat hunting and investigation.

Learn more

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ451

Community Discussion