Câu 24: CAS-005: CompTIA SecurityX

A systems administrator is working with the SOC to identify potential intrusions associated with ransomware. The SOC wants the systems administrator to perform network-level analysis to identify outbound traffic from any infected machines. Which of the following is the most appropriate action for the systems administrator to take?

1. A. Monitor for IoCs associated with C&C communications.
2. B. Tune alerts to Identify changes to administrative groups.
3. C. Review NetFlow logs for unexpected increases in egress traffic. — đáp án hiện tại
4. D. Perform binary hash comparisons to identify infected devices.