200-201 Question 392
Select 3As a cybersecurity analyst, you are tasked with investigating unusual activity on a company's network. During your analysis, you come across an alert related to Potentially Suspicious Indicators (PSI) on a host. Which of the following actions would be most appropriate to validate whether the activity is malicious or benign?
- A
Analyze the host’s event logs to identify any unusual processes or application activity.
- B
Isolate the host from the network immediately to prevent further potential damage.
- C
Compare the PSI details against known threat intelligence sources for confirmation of malicious behavior.
- D
Ignore the alert, as PSI is not always indicative of a real threat.
- E
Perform a full system scan on the host to detect any malware or unauthorized changes.
Show answer and explanation
Correct answers: A, C, E
Explanation
Potentially Suspicious Indicators (PSI) are not definitive signs of malicious activity but require thorough investigation to determine their nature. Analyzing event logs, comparing PSI details with threat intelligence, and performing system scans are effective ways to validate the activity. While PSI may not always indicate a real threat, ignoring it without proper investigation could leave the system vulnerable to undetected attacks. Immediate isolation is not always justified unless malicious activity is confirmed.
- A. Correct.
Analyzing event logs is a critical step in investigating PSI. It helps identify irregularities and understand whether the activity aligns with known malicious behavior.
- B. Incorrect.
Isolating the host immediately is not always necessary for PSI unless there is clear evidence of malicious activity. Premature isolation may disrupt business operations.
- C. Correct.
Comparing the PSI with threat intelligence sources can help validate whether the indicators are associated with known threats.
- D. Incorrect.
Ignoring the alert is not recommended, as even potentially suspicious indicators warrant investigation to rule out malicious activity.
- E. Correct.
Performing a full system scan can uncover malware or unauthorized changes, providing additional evidence to confirm whether the PSI is indicative of a threat.