The Analyst Has Created a Correlation Rule to Correlate Events

question 6

Multiple Choice

The analyst has created a correlation rule to correlate events from Anti-Virus (AV) , Network Intrusion Prevention (NIPS) and the firewall. While reviewing just firewall events, the analyst notices a large spike in outbound Command and Control traffic; however, the correlation rule is not triggering. The analyst then looks at the Network IPS and the Anti-Virus views and notices there are no alerts for this traffic. Which of the following features of NIPS and AV are most likely turned off?

• A) Alerting
• B) Heuristics
• C) Advanced Persistent Threats (APT)
• D) Automatic DAT updates

---

Definitions:

Rituals

Established sequences of activities involving gestures, words, actions, or objects, performed according to set sequences and intended to influence or symbolize a value or belief within a culture or organization.

Dominant Culture

The set of norms, values, beliefs, and practices that is accepted and upheld by the majority within a society or organization.

Adaptive Organizational Culture

Refers to a culture within an organization that is flexible, agile, and capable of adapting to change or environmental demands.

Organizational Goals

The objectives or targets that an organization aims to achieve within a specified timeframe, guiding its strategic and operational activities.