Câu 119: CS0-002: CompTIA CySA+ Certification Exam (CS0-002)

A security analyst at example.com receives SIEM alert for an IDS signature and reviews the associated packet capture and TCP stream:Packet capture: TCP stream: Which of the following actions should the security analyst take NEXT?

1. A. Review the known Apache vulnerabilities to determine if a compromise actually occurred.
2. B. Contact the application owner for connect.example.local for additional information. — đáp án hiện tại
3. C. Mark the alert as a false positive scan coming from an approved source.
4. D. Raise a request to the firewall team to block 203.0.113.15.