3.4 Interpret the Sequence of Events During an Attack Based on Predictive AI Analysis of Traffic Patterns 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A predictive AI tool identifies a sequence of events indicating a ransomware attack: (1) a user opens a malicious attachment, (2) a PowerShell script downloads a ransomware binary, (3) the binary encrypts files on the local machine and network shares, (4) the machine displays a ransom note. The security team has a backup solution that can restore encrypted files, but the restore process takes 4 hours. Which action should be prioritized to minimize the impact?

   • ARun an antivirus scan on the infected machine to remove the ransomware.
   • BImmediately start the restore process from backups.
   • CIsolate the infected machine and all machines that share the affected network shares.
   • DDisconnect the network shares to prevent further encryption.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A predictive AI system flags a sequence of events for a user: (1) the user logs in from a new IP address, (2) the user accesses a file share, (3) the user transfers a file to an external cloud service. The AI assigns a high risk score. The user is a known remote worker who frequently travels. However, the file share contains sensitive project data, and the cloud service is a personal Dropbox account. The analyst must decide whether to escalate this as a potential data exfiltration. Which combination of factors most strongly supports escalation?

   • AThe user recently changed their password and enabled MFA, and the file transfer was small.
   • BThe user's travel pattern does not include the new IP's location, and the file share is unrelated to the user's current project.
   • CThe user frequently uses personal cloud services for work, and the file share is accessible to all employees.
   • DThe user is a senior executive with access to many file shares, and the cloud service is commonly used in the company.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which incident response action is most directly supported by predictive AI insights indicating that a host is likely to be used for lateral movement next?

   • AConducting a full forensic analysis of every device in the organization
   • BIgnoring the alert because it is only a prediction
   • CChanging the host's IP address to a different subnet
   • DIsolating the host from the network to prevent further spread
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security operations center (SOC) uses a predictive AI tool that flags attack sequences. The tool reports the following for a compromised workstation: (1) a user opens a phishing attachment, (2) a PowerShell script downloads a payload, (3) the payload creates a scheduled task, (4) the workstation begins scanning the internal network. The SOC has a policy to contain threats immediately, but the workstation is used by a remote employee who is currently on a critical video call. The analyst must balance containment with business continuity. Which action best balances the need to stop the attack with the need to maintain the employee's productivity?

   • AIsolate the workstation from the network immediately, then provide the employee with a loaner device.
   • BAllow the video call to finish, then isolate the workstation.
   • CBlock only the PowerShell script's download IP, but leave the workstation connected.
   • DDisable the user's account, but leave the workstation connected.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A predictive AI system reports the following alert sequence for a server: (1) a brute-force attack on SSH, (2) a successful SSH login, (3) a privilege escalation command, (4) a connection to an external IP on port 4444. The incident response team has a playbook that says to block the attacking IP first. However, the AI indicates the attack is already at the command and control stage. Which action is the most effective next step?

   • ADisable the server's network interface.
   • BChange the SSH port to a non-standard port.
   • CBlock the external IP on port 4444 and terminate the SSH session.
   • DBlock the brute-force source IP at the firewall.
   Reveal Solution Discussion Select an answer first