350-201 Question 204
Select 3You are a cybersecurity analyst at a mid-sized enterprise. After performing an investigation on a recent network intrusion, you’ve collected detailed evidence, identified the attacker’s tactics, and mitigated the threat. The management team has requested a summary report of the incident. What key elements should you include in this report to effectively share the results and support future mitigation efforts?
- A
A detailed timeline of the attack from initial intrusion to mitigation.
- B
Technical jargon and raw data logs to showcase advanced analysis skills.
- C
Recommendations for improving current security measures.
- D
A summary of the attacker’s tactics, techniques, and procedures (TTPs).
- E
Personal opinions on the potential motives of the attacker.
Show answer and explanation
Correct answers: A, C, D
Explanation
An effective summary report should include a structured timeline of the incident, a summary of the attacker’s methods (TTPs), and actionable recommendations for improving security. This ensures that the organization can learn from the incident and bolster its defenses. Avoid including unnecessary technical details or speculative elements that may detract from the report's focus and usability.
- A. Correct.
Including a detailed timeline is critical for understanding the sequence of events and identifying areas for improvement in detection and response processes.
- B. Incorrect.
While raw data logs may be useful during the technical investigation, they should not be the focus of a summary report intended for management. Instead, actionable insights should be prioritized.
- C. Correct.
Providing recommendations for improving security measures ensures the organization can address gaps and prevent similar incidents in the future.
- D. Correct.
Summarizing the attacker’s TTPs is essential for understanding the methods used and for preparing defenses against similar threats in the future.
- E. Incorrect.
Personal opinions, especially on motives, are speculative and may not provide actionable value in a professional summary report.