Câu 30: SPLK-5003: Splunk Certified Cybersecurity Defense Architect

Buttercup Games’ incident response team has found IOC’s related to the “Water Curse” campaign within their dev environment. Suspicious activity shows unauthorized access to developer workstations and potential manipulation to their source code in their version control software, GitLow. Given “Water Curse’s” known weaponization of open-source dependencies, a forensic investigation is required to determine the breach’s full scope, identify affected systems, and collect evidence. To support a forensic investigation into the “Water Curse” compromise at Buttercup Games, what triage steps should be performed? (Choose all that apply.)

1. A. Immediately re-image all potentially compromised developer workstations.
2. B. Review recent commits and pull requests from potentially compromised developers. — đáp án hiện tại
3. C. Collect volatile memory and disk images. — đáp án hiện tại
4. D. Analyze the network traffic and focus on deep packet inspection to identify command and control activity. — đáp án hiện tại