6.1 Create Custom IOA Rules to Monitor for Behavior That Is Not Fundamentally Malicious CCFA Practice Questions (Page 4)

Questions 16–16

1. 16application · medium

   A security administrator wants to create a custom IOA rule to monitor for the use of a specific administrative tool that is not malicious but is often used by attackers for reconnaissance. The administrator wants to be alerted when the tool is used with a specific set of command-line arguments that are commonly associated with reconnaissance. What is the primary purpose of this custom IOA rule?

   • ATo automatically remediate the system by terminating the process when the reconnaissance arguments are detected.
   • BTo replace the need for a prevention policy by providing real-time visibility into the tool's usage.
   • CTo block the execution of the administrative tool when it is used with the reconnaissance arguments.
   • DTo monitor for the use of the administrative tool with the reconnaissance arguments and generate an alert when detected.
   Reveal Solution Discussion Select an answer first