Question 40: NetSec-Analyst: Palo Alto Networks Certified Network Security Analyst

A malware incident involving compromised internal hosts communicating with a command-and-control (C2) server has been resolved. In response, the C2 IP address is blocked. Which two actions using the Log Viewer will ensure the incident has been fully mitigated? (Choose two.)

1. A. Build and save a custom filter based on the affected endpoints and continue to monitor for suspicious traffic from the endpoints. — đáp án hiện tại
2. B. Review the authentication alerts on the affected devices.
3. C. Review the audit alerts and check for integrity protection alerts on the affected devices.
4. D. Continue to monitor for traffic going to the C2 server's IP address. — đáp án hiện tại