3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of the final report in an endpoint intrusion investigation?

   • ATo justify the cost of the investigation
   • BTo assign blame to specific employees
   • CTo provide a list of all software installed on the endpoint
   • DTo document findings and recommend remediation actions
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After investigating a compromised desktop, the analyst determines that the attacker used a known vulnerability in a third-party application to gain access. The analyst has collected evidence and identified the scope of the intrusion. What should the analyst include in the remediation recommendations?

   • ASubmit the evidence to law enforcement and close the case.
   • BReimage the desktop and restore from the most recent backup.
   • CDelete the malicious files and disable the user's account.
   • DPatch the vulnerable application, rotate affected credentials, and monitor for signs of persistence.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   After a thorough investigation, an analyst determines that an attacker compromised a user's laptop via a phishing email and used the compromised account to access a file server. The analyst has identified the scope and collected evidence. Which remediation plan best addresses the root cause and prevents recurrence?

   • AReset the compromised user's password, enforce multi-factor authentication, and provide security awareness training on phishing.
   • BReimage the laptop and restore the user's files from backup.
   • CBlock the phishing email sender's address and delete the email from all mailboxes.
   • DDisable the user's account and create a new account with the same permissions.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is investigating a series of failed login attempts on a corporate VPN. The analyst finds that the attempts originated from a single external IP address and targeted multiple user accounts. Which additional data source would best help determine if any of the accounts were successfully compromised?

   • AReview the VPN authentication logs for successful logins from that IP address after the failed attempts.
   • BSearch the web for the external IP address in threat intelligence feeds.
   • CReview the firewall logs for outbound connections from the VPN server.
   • DCheck the external IP address's geolocation to determine the attacker's physical location.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   After investigating a compromised mobile device, the analyst determines that the device was jailbroken and a malicious app was installed. The analyst has collected evidence and identified the scope. What should the analyst recommend as the primary remediation step?

   • AUninstall the malicious app and change the device passcode.
   • BBack up the device data and then restore from the backup.
   • CRestore the device to factory settings and update to the latest OS version.
   • DDisable the device's Bluetooth and Wi-Fi to prevent further communication.
   Reveal Solution Discussion Select an answer first