Describe Role of Visibility and Analytics ZERO-TRUST-DESIGN Practice Questions (Page 6)

Questions 26–26

1. 26application · medium

   A retail company's SOC receives an alert that a user's account has been locked out due to multiple failed logon attempts. Separately, the EDR system flags that the same user's workstation is communicating with a known malicious IP address. How should the SOC interpret these two events?

   • ATreat them as independent incidents and investigate each one separately.
   • BImmediately block the user's account and the workstation without further analysis.
   • CCorrelate the events to determine if the failed logons and the malicious communication are part of the same attack chain.
   • DIgnore the failed logons because they are a common occurrence and focus only on the malicious IP communication.
   Reveal Solution Discussion Select an answer first