Question

A cybersecurity analyst is analyzing a complex set of threat intelligence data from internal and external sources. Among the data, they discover a series of indicators, including patterns of unusual network traffic, a sudden increase in failed login attempts, and multiple instances of suspicious file access on the company's internal servers. Additionally, an external threat feed highlights that threat actors are actively targeting organizations in the same industry using ransomware. Which action should the analyst recommend?

Accepted Answer

Propose isolation of affected systems and activating the incident response plan because the organization is likely under attack by the new ransomware strain.

Answer

Advise on monitoring the situation passively because network traffic anomalies are coincidental and unrelated to the ransomware threat.

Answer

Advocate providing additional training on secure login practices because the increase in failed login attempts is likely a result of employee error.

Answer

Notify of no requirement for immediate action because the suspicious file access incidents are normal operational activities and do not indicate an ongoing threat.

A cybersecurity analyst is analyzing a complex set of threat intelligence data from internal and external sources. Among the data, they discover a…

Take the free 300-215 practice test

Other 300-215 practice questions