Câu 9: CAS-005: CompTIA SecurityX
A security analyst is investigating a possible insider threat incident that involves the use of an unauthorized USB from a shared account to exfiltrate data. The event did not create an alert. The analyst has confirmed the USB hardware ID is not on the device allow list, but has not yet confirmed the owner of the USB…
Nội dung câu hỏi
A security analyst is investigating a possible insider threat incident that involves the use of an unauthorized USB from a shared account to exfiltrate data. The event did not create an alert. The analyst has confirmed the USB hardware ID is not on the device allow list, but has not yet confirmed the owner of the USB device. Which of the following actions should the analyst take next?
Các lựa chọn
Đáp án được giữ gọn theo nhãn A, B, C, D trong phần bình chọn tương tác.
- A. Classify the incident as a false positive.
- B. Classify the incident as a false negative. — đáp án hiện tại
- C. Classify the incident as a true positive.
- D. Classify the incident as a true negative.
Cộng đồng
0 bình luận công khai. Tên thành viên được ẩn một phần.