A SIEM Tool Fires an Alert About a VPN Connection

question 17

Multiple Choice

A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user's laptop while traveling. The attacker has the user's credentials and is attempting to connect to the network. What is the next step in handling the incident?

• A) Block the source IP from the firewall
• B) Perform an antivirus scan on the laptop
• C) Identify systems or services at risk
• D) Identify lateral movement

---

Definitions:

Initial Investment

The amount of money used to start an investment, often the starting capital for a business or financial venture.

Gain on Sale

The financial profit realized when an asset is sold for more than its original purchase price or book value.

Jointly Controlled Operation

A business activity where two or more parties share control and decision-making responsibilities.