Câu 6: 300-215: Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Refer to the exhibit. An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hour prior. Which two indicators of compromise should be determined from this information? (Choose two.)

1. A. unauthorized system modification — đáp án hiện tại
2. B. privilege escalation
3. C. denial of service attack
4. D. compromised root access — đáp án hiện tại
5. E. malware outbreak