200-201 Question 181
Single answerA security operations team is using a host-based intrusion detection system (HIDS) to monitor a critical server. During routine analysis, the HIDS generates an alert indicating a modified system file that was not part of a planned update. Which action should the team prioritize to determine whether this is a legitimate threat?
- A
Verify the file's hash against a known-good baseline.
- B
Immediately delete the modified file to contain the potential threat.
- C
Disable the HIDS temporarily to prevent further alerts.
- D
Investigate recent user activity and system logs for unauthorized changes.
Show answer and explanation
Correct answer: A
Explanation
Host-based intrusion detection systems (HIDS) monitor changes to a host system, such as unauthorized file modifications. When alerted, the first step is to verify the integrity of the affected file. This is done by comparing its hash value to a known-good baseline to determine if the modification is legitimate or malicious. Subsequent actions, such as investigating user activity or taking containment measures, depend on the results of this verification.
- A. Correct.
This is the correct action. Verifying the file's hash against a known-good baseline helps confirm whether the file was legitimately modified or tampered with by a potential attacker.
- B. Incorrect.
This is not recommended as it is a premature action. Deleting the file without investigation can disrupt legitimate processes if the file is critical and not actually malicious.
- C. Incorrect.
Disabling the HIDS is ineffective and counterproductive, as it removes the system's ability to detect further threats.
- D. Incorrect.
While investigating user activity and logs is important, it should not be the first step. The priority is to determine the legitimacy of the file modification by comparing its hash with a trusted baseline.