200-201 Question 189
Select 3A cybersecurity analyst at a Security Operations Center (SOC) is investigating an incident where a user's credentials were compromised. The investigation reveals that the attacker leveraged a phishing email to trick the user into entering their credentials on a fake login page. Which of the following could the analyst use to confirm the scope of the incident and contain the threat?
- A
Review the email headers to verify the source of the phishing email
- B
Analyze log files for unusual login attempts from the compromised account
- C
Update the organization's firewall rules to block the phishing URL
- D
Instruct the user to change their password and enable multifactor authentication
- E
Perform a vulnerability scan on the user's workstation to identify any malware
Show answer and explanation
Correct answers: A, B, D
Explanation
To confirm the scope of the incident, the analyst should review email headers to understand how the phishing email was delivered, analyze log files for evidence of unauthorized access, and ensure the user's account is secured by changing the password and enabling multifactor authentication. Blocking the phishing URL and scanning for malware are preventative or additional investigative measures but are less relevant for directly scoping and containing this specific incident.
- A. Correct.
Reviewing email headers can help confirm the origin of the phishing email and potentially identify the attacker or infrastructure used in the attack.
- B. Correct.
Analyzing log files allows the analyst to identify unauthorized access attempts, helping to determine the scope of the incident.
- C. Incorrect.
Updating firewall rules to block the phishing URL is a good long-term measure but does not directly address the scope of the current incident or contain the threat.
- D. Correct.
Instructing the user to change their password eliminates the immediate threat of unauthorized access, while enabling multifactor authentication adds an additional layer of security.
- E. Incorrect.
Performing a vulnerability scan on the workstation might help identify malware, but phishing attacks are often credential-based and may not involve system vulnerabilities.