200-201 Question 373
Single answerDuring a routine network scan, a cybersecurity analyst discovers that an unauthorized user has accessed a critical asset. The analyst realizes that the critical asset's IP address was not documented or included in the organization's monitoring system. What should the analyst do first to ensure proper management of critical asset address space in the future?
- A
Document all critical assets' IP addresses and update the asset inventory.
- B
Block all external traffic to the organization's network immediately.
- C
Isolate the compromised system and continue monitoring for further unauthorized activity.
- D
Perform a full system backup for all critical assets before making any changes.
Show answer and explanation
Correct answer: A
Explanation
The first step in ensuring proper management of critical asset address space is to document all critical assets' IP addresses and update the organization's asset inventory. This ensures that monitoring systems can track and protect these assets, reducing the risk of unauthorized access in the future. While other actions may be necessary depending on the incident, accurate documentation is foundational to effective cybersecurity operations.
- A. Correct.
Documenting all critical assets' IP addresses and updating the asset inventory is the first step to ensure future monitoring and management of critical asset address space. Without proper documentation, monitoring systems cannot effectively protect these assets.
- B. Incorrect.
Blocking all external traffic is an extreme measure that can disrupt legitimate business operations. While it may be necessary in certain scenarios, it is not the first step in managing critical asset address space.
- C. Incorrect.
Isolating the compromised system is a valid incident response step but does not address the broader issue of managing critical asset address space.
- D. Incorrect.
Performing a full system backup is a good practice but does not directly address the problem of documenting and managing critical asset IP addresses.