An Incident Responder Observes an Incident with Multiple Malware Downloads

question 65

Multiple Choice

An Incident Responder observes an incident with multiple malware downloads from a malicious domain. The domain in question belongs to one of the organization's suppliers. The organization needs access to the site to continue placing orders. ATP: Network is configured in Inline Block mode. How should the Incident Responder proceed?

• A) Whitelist the domain and close the incident as a false positive
• B) Identify the pieces of malware and blacklist them, then notify the supplier
• C) Blacklist the domain and IP of the attacking site
• D) Notify the supplier and block the site on the external firewall

---

Definitions:

Total Current Assets

The sum of all assets of a company expected to be converted into cash within one financial year.

Accounts Receivable

Money owed to a business by its clients or customers for goods or services delivered or used but not yet paid for.

Current Liabilities

Financial obligations a company owes and is due to pay within a year.

Total Current Assets

The sum of all assets expected to be converted into cash within one year.