Câu 21: 312-39V2: Certified SOC Analyst (CSA) v2

A SIEM alert is triggered due to unusual network traffic involving NetBIOS. The System log shows that “The TCP/IP NetBIOS Helper service entered the running state”. Concurrently, Event Code 4624: “An account was successfully logged on” appears for multiple machines within a short time frame. The logon type is identified as 3 (Network logon). Which of the following security incidents is the SIEM detecting?

1. A. A user connecting to shared files from multiple workstations
2. B. A malware infection spreading via SMB protocol
3. C. A network administrator conducting routine maintenance
4. D. An attacker performing lateral movement within the network — đáp án hiện tại