200-201 Question 191
Single answerDuring a cybersecurity investigation, a security analyst identifies an IP address linked to malicious activity. The analyst begins investigating further to determine the source of the attack, including whether it is an individual, group, or nation-state actor. Which aspect of the investigation is the analyst focusing on?
- A
Attribution
- B
Containment
- C
Eradication
- D
Vulnerability assessment
Show answer and explanation
Correct answer: A
Explanation
Attribution plays a critical role in cybersecurity investigations by helping analysts identify the source or actor behind an attack. This can guide response efforts, assist with legal actions, and improve organizational defenses against similar threats in the future. In this scenario, the analyst's efforts to determine the responsible party align with attribution.
- A. Correct.
Attribution is the process of identifying who is responsible for an attack or malicious activity. In this scenario, the analyst is working to determine the source of the attack, which directly relates to attribution.
- B. Incorrect.
Containment focuses on limiting the impact of an ongoing attack, such as isolating affected systems. While important, it is not the focus of this scenario.
- C. Incorrect.
Eradication involves removing the threat from the environment, such as cleaning malware from infected systems. This is not related to the analyst's current focus on identifying the attacker.
- D. Incorrect.
Vulnerability assessment is the process of identifying and evaluating potential security weaknesses in a system. This is unrelated to determining the source of an attack.