200-201 Question 190
Single answerDuring a cybersecurity investigation, a security analyst identifies suspicious activity originating from an external IP address. The analyst's objective is to determine the entity behind the attack and their motives. Which of the following describes the role of attribution in this investigation?
- A
Identifying the tools and techniques used in the attack to understand the attack vector
- B
Determining the responsible party behind the attack and their intent
- C
Mitigating the attack by blocking the malicious IP address
- D
Collecting evidence to support legal actions against the attacker
Show answer and explanation
Correct answer: B
Explanation
Attribution plays a critical role in cybersecurity investigations by focusing on identifying the entity responsible for an attack and their motives. This helps organizations understand the threat actor's intentions and capabilities, which is essential for developing an appropriate response and enhancing overall defense strategies.
- A. Incorrect.
While identifying tools and techniques is crucial for understanding the attack vector, it does not directly relate to attribution, which focuses on identifying the actor and their intent.
- B. Correct.
This is correct because attribution in an investigation focuses on uncovering the responsible party and understanding their motives, which helps in contextualizing the threat.
- C. Incorrect.
Mitigation is an important step in incident response but does not involve attribution. Blocking the IP address might stop the attack but does not identify the attacker.
- D. Incorrect.
Although collecting evidence is part of an investigation, it is aimed at supporting legal or operational actions, not specifically attribution.