350-201 Question 209
Select 4A security analyst receives an alert indicating suspicious activity on an employee's laptop. The analyst must determine whether the device has been compromised. Which of the following steps should the analyst take to investigate this potential endpoint intrusion effectively?
- A
Check for unusual processes or services running on the endpoint using task manager or equivalent tools.
- B
Analyze network traffic originating from the endpoint for anomalous behavior.
- C
Immediately reformat the laptop to prevent further damage.
- D
Review the endpoint's security event logs and audit trails for unauthorized access attempts.
- E
Scan the device using the organization's antivirus or endpoint detection and response (EDR) solution.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To investigate potential endpoint intrusions, a structured approach is necessary to gather evidence and identify the root cause. This includes analyzing processes, network traffic, logs, and using detection tools. Immediate reformatting, while tempting, should only be considered as a last resort after evidence collection is complete to ensure forensic data is preserved.
- A. Correct.
Checking for unusual processes or services is critical as malicious software often manifests as unexpected or suspicious processes.
- B. Correct.
Analyzing network traffic can help identify abnormal connections or data exfiltration attempts associated with the endpoint.
- C. Incorrect.
Reformatting the laptop immediately is not recommended as it can destroy evidence crucial for investigation and attribution.
- D. Correct.
Reviewing security event logs and audit trails can provide insight into unauthorized access or changes made to the system.
- E. Correct.
Scanning the device with antivirus or EDR tools helps detect and identify known threats or suspicious activities.