Câu 311: 312-50V13: Certified Ethical Hacker v13

As a cybersecurity professional in XYZ Corporation, you’ve been assigned to investigate an anomaly in the system logs that suggest possible unauthorized activities. The system administrators detected repeated failed login attempts on a critical server, followed by a sudden surge in outbound data traffic. These events, while discrete, are raising concerns that the system may have been compromised. Given the high stakes and sophisticated nature of this potential security breach, what should be your initial course of action to manage this situation effectively?

1. A. Immediately alter the credentials of the server and notify all users to change their passwords.
2. B. Immediately disconnect the suspicious server from the network to prevent further data exfiltration.
3. C. Conduct real-time monitoring of the server, scrutinize the logs for unusual patterns, and identify the nature of the activities to devise an immediate countermeasure. — đáp án hiện tại
4. D. Conduct a thorough audit of all outbound traffic and scrutinize the destination IPs to gain insights into the attacker’s network.