350-201 Question 211
Select 3An organization suspects that a critical endpoint, a company-issued laptop, has been compromised by a potential intrusion. Using Cisco Secure Endpoint, what steps should a cybersecurity analyst take to investigate the potential intrusion effectively?
- A
Examine the endpoint's process history and identify any suspicious processes or applications.
- B
Only rely on the antivirus logs to determine if any malware is detected on the endpoint.
- C
Analyze file trajectory to trace the origin of the suspicious files and their movement across the network.
- D
Quarantine the endpoint immediately without further analysis to prevent spreading.
- E
Review executed scripts and commands on the endpoint for abnormal activities.
Show answer and explanation
Correct answers: A, C, E
Explanation
Investigating potential endpoint intrusions requires a systematic approach to identify indicators of compromise and trace the attack's behavior. Key steps include analyzing process history, file trajectory, and executed commands to detect anomalous or malicious activities. These steps provide a comprehensive understanding of the intrusion, enabling effective mitigation. Relying solely on antivirus logs or prematurely quarantining the endpoint without analysis may lead to incomplete investigations or operational disruptions.
- A. Correct.
Examining the endpoint's process history is a critical step in identifying suspicious activities, such as unknown or unauthorized processes that may indicate an intrusion.
- B. Incorrect.
Relying solely on antivirus logs is insufficient, as advanced threats or fileless malware may bypass traditional antivirus detection mechanisms.
- C. Correct.
Analyzing file trajectory helps trace the origin and behavior of suspicious files, providing key insights into the attack vector and potential lateral movement.
- D. Incorrect.
Quarantining the endpoint without proper analysis may disrupt operations unnecessarily and hinder the investigation process. It should only be done after confirming malicious activity.
- E. Correct.
Reviewing executed scripts and commands can uncover unusual or unauthorized actions performed on the endpoint, which is crucial for detecting advanced threats.