300-215 practice question 6 of 25

A cybersecurity analyst is analyzing a complex set of threat intelligence data from internal and external sources. Among the data, they discover a…

A cybersecurity analyst is analyzing a complex set of threat intelligence data from internal and external sources. Among the data, they discover a series of indicators, including patterns of unusual network traffic, a sudden increase in failed login attempts, and multiple instances of suspicious file access on the company's internal servers. Additionally, an external threat feed highlights that threat actors are actively targeting organizations in the same industry using ransomware. Which action should the analyst recommend?

Answer options

A: Advise on monitoring the situation passively because network traffic anomalies are coincidental and unrelated to the ransomware threat.

B: Propose isolation of affected systems and activating the incident response plan because the organization is likely under attack by the new ransomware strain. Correct answer

C: Advocate providing additional training on secure login practices because the increase in failed login attempts is likely a result of employee error.

D: Notify of no requirement for immediate action because the suspicious file access incidents are normal operational activities and do not indicate an ongoing threat.

Correct Answer:

B. Propose isolation of affected systems and activating the incident response plan because the organization is likely under attack by the new ransomware strain.

Explanation

The scenario presents multiple, correlated indicators of compromise (IoCs) that align with both internal observations and external threat intelligence. The combination of unusual network traffic, a spike in failed logins, and suspicious file access, when contextualized with an active ransomware campaign targeting the industry, strongly suggests an ongoing attack. According to standard incident response frameworks, the immediate priority is to contain the threat to prevent further damage and lateral movement. Isolating affected systems is a critical containment step, and activating the formal incident response plan ensures a structured, coordinated, and effective reaction to the security incident.

Why Incorrect

A. Passive monitoring is a negligent response, as the correlated indicators strongly suggest an active threat, not a coincidence, requiring immediate action to mitigate risk.
C. While valuable for long-term prevention, user training is not an appropriate immediate response to what appears to be an active, malicious intrusion.
D. Dismissing multiple, strong, and contextualized threat indicators as "normal" without investigation is a critical error that could lead to a catastrophic breach.

References

1. NIST Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 3.2, "Containment, Eradication, & Recovery," states, "Containment is the first step in recovery... an essential part of the process is to make a decision on the most effective strategy for containing the incident." Section 3.2.2, "Containment Strategy," further details that containment actions can include isolating a network segment or disconnecting individual systems. This supports isolating systems and activating the plan.

2. Cisco, "Threat-Centric Incident Response Playbook" (2017). The playbook emphasizes the importance of moving from detection to containment swiftly. In the "Containment" phase (p. 10), it outlines actions such as "Isolate the host from the network" and "Block malicious IP addresses" as primary steps after identifying a credible threat, which aligns directly with the recommended action.

3. Carnegie Mellon University, Software Engineering Institute, "Defining Incident Response" (2017). This document outlines the incident response lifecycle. The "Analysis" phase involves correlating data from multiple sources (as the analyst has done). The immediate next step is "Containment," described as actions taken to "stop the incident from causing further damage," which validates the need to isolate systems and formally manage the response. (Reference: CERT/CC, Incident Management Team).

Keep practicing

Take the free 300-215 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test