200-201 Question 175
Single answerA security analyst is investigating an alert from an endpoint detection and response (EDR) system. The alert indicates that a suspicious process is running on a host. Upon further investigation, the analyst notices the process is attempting to connect to an IP address that is known to be associated with a malware command and control (C2) server. What should the analyst do next to mitigate the threat?
- A
Terminate the suspicious process immediately and isolate the host from the network.
- B
Take no action until additional alerts confirm malicious activity.
- C
Manually delete the executable file associated with the suspicious process.
- D
Monitor the process activity and document all connections for future investigation.
Show answer and explanation
Correct answer: A
Explanation
When dealing with a suspicious process that is confirmed to be communicating with a known malicious C2 server, immediate containment is critical. Terminating the process and isolating the host prevents further communication with the attacker, minimizes potential damage, and allows for a controlled investigation of the incident.
- A. Correct.
Terminating the process and isolating the host is the best course of action to prevent further damage or data exfiltration. This action ensures the threat is contained while further analysis can be performed.
- B. Incorrect.
Waiting for additional alerts could allow the malware to spread, exfiltrate data, or cause further damage. This is not a proactive approach to mitigating the threat.
- C. Incorrect.
Manually deleting the executable file may not fully remove the malware, as malicious processes could have persistence mechanisms or dependencies. This is not a comprehensive mitigation step.
- D. Incorrect.
While monitoring activity can provide additional context, it does not address the immediate threat. The malware could continue operating and cause harm during this time.