CompTIA Exam CAS-004 Topic 10 Question 47 Discussion

Actual exam question for CompTIA's CAS-004 exam

Question #: 47
Topic #: 10

[All CAS-004 Questions]

A SOC analyst received an alert about a potential compromise and is reviewing the following SIEM logs:

Which of the following is the most appropriate action for the SOC analyst to recommend?

ADisabling account JDoe to prevent further lateral movement

BIsolating laptop314 from the network

CAlerting JDoe about the potential account compromise

DCreating HIPS and NIPS rules to prevent logins

Show Suggested Answer

Suggested Answer: B

The SIEM logs indicate suspicious behavior that could be a sign of a compromise, such as the launching of cmd.exe after Outlook.exe, which is atypical user behavior and could indicate that a machine has been compromised to perform lateral movement within the network. Isolating laptop314 from the network would contain the threat and prevent any potential spread to other systems while further investigation takes place.

by Derick at Apr 14, 2024, 06:00 PM

Limited Time Offer

25%

Off

Get Premium CAS-004 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Nina

5 months ago

Creating HIPS and NIPS rules to prevent logins could also be a good proactive measure to secure the system.

upvoted 0 times

...

Bambi

5 months ago

But what about isolating laptop314 from the network? Wouldn't that also prevent any further damage?

upvoted 0 times

...

Josphine

5 months ago

I agree with User1, disabling the account would stop the potential compromise from spreading.

upvoted 0 times

...

Carma

5 months ago

I think the most appropriate action is to disable account JDoe to prevent further lateral movement.

upvoted 0 times

...

Edelmira

5 months ago

Yes, that could be another effective action to take in this situation.

upvoted 0 times

...

Nobuko

5 months ago

But shouldn't we also disable account JDoe to prevent further lateral movement?

upvoted 0 times

...

Isaiah

6 months ago

I agree, that would help contain the potential compromise.

upvoted 0 times

...

Gianna

6 months ago

I think the analyst should isolate laptop314 from the network.

upvoted 0 times

...

Bok

7 months ago

Creating HIPS and NIPS rules? That's overkill. We don't even know the extent of the compromise yet. Let's not jump the gun and make things worse, shall we?

upvoted 0 times

...

Xochitl

7 months ago

You know, I'm kinda leaning towards the HIPS and NIPS approach too. It's like building a cybersecurity force field around the whole system, and who doesn't love a good force field?

upvoted 0 times

...

Armando

7 months ago

I don't know, guys. Alerting the user seems like a reasonable first step. They might be able to provide more context or even help us identify the source of the issue.

upvoted 0 times

...

Sanjuana

7 months ago

Hold up, what about creating those HIPS and NIPS rules? Seems like a pretty proactive move to me. I mean, if we can shut down those login attempts before they even happen, that's gotta be the way to go, right?

upvoted 0 times

...

Vallie

7 months ago

Haha, yeah, like that IT guy who once tried to 'fix' a virus by just unplugging the whole office. That worked out really well, I'm sure.

upvoted 0 times

...

Kanisha

7 months ago

Nah, I'm not feeling the 'alert JDoe' option. What if the dude's in on it? Then he'll just change his password and keep doing his thing. I say we go for the disable account and isolate laptop combo - cover all our bases, you know?

upvoted 0 times

...

Izetta

7 months ago

Yeah, I agree. We should probably start with the least intrusive option and see where that takes us. No need to go full-on security lockdown mode just yet.

upvoted 0 times

...

Melita

7 months ago

Personally, I think the best move is to alert JDoe about the potential compromise. I mean, the guy's account is involved, he should know what's going on, right? Plus, it might help us figure out what the heck is happening on that laptop.

upvoted 0 times

...

Grover

7 months ago

Hmm, this is a tough call. I'd be tempted to go with isolating the laptop, you know, just to be on the safe side. But then again, that might tip off the bad guys and they could try something even sneakier. Decisions, decisions...

upvoted 0 times

...

Raina

7 months ago

Whoa, looks like we've got a real tricky one here! I mean, disabling the account, isolating the laptop, warning the user - it's like a choose your own adventure game, but with cybersecurity stakes!

upvoted 0 times