300-215 Question 144
Select 4An organization has detected unusual activity on their network, leading them to suspect a zero-day exploit is being used. As part of their response plan, the team is tasked with leveraging their SIEM solution and AI-based predictive vulnerability management system to assess and mitigate the risk. Which steps should the team take to effectively respond to the threat?
- A
Perform a risk assessment to prioritize affected systems based on criticality and exposure.
- B
Isolate potentially compromised systems immediately to prevent further spread of the exploit.
- C
Leverage the SIEM to analyze historical data and correlate events to identify the exploit’s behavior.
- D
Deploy patches to all systems preemptively, even without understanding the exploit's scope.
- E
Utilize AI-based predictive tools to identify other vulnerabilities that could be targeted next.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Responding to a zero-day exploit requires a systematic approach that includes risk assessment, containment, and leveraging advanced tools like SIEM and AI-based predictive vulnerability management. These steps ensure the threat is understood, contained, and mitigated effectively while preventing future exploitation of similar vulnerabilities. Preemptive patching without understanding the exploit's scope is not recommended, as it may lead to negative consequences such as system instability or overlooking the actual issue.
- A. Correct.
Performing a risk assessment is crucial to identify which systems are most critical and exposed, allowing for prioritization in mitigation efforts.
- B. Correct.
Isolating compromised systems is a standard response to prevent an exploit from spreading further in the network.
- C. Correct.
SIEM solutions provide valuable insight by analyzing and correlating network events, helping to identify the exploit's behavior and timeline.
- D. Incorrect.
Deploying patches without understanding the exploit’s scope can introduce instability or fail to address the issue, making this a risky and inappropriate step.
- E. Correct.
AI-based predictive tools can help identify other potential vulnerabilities, assisting in proactive risk mitigation during a zero-day attack.