A Security Is Responding to an Incident on a Web

question 56

Multiple Choice

A security is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS. Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise?

• A) Run an anti-malware scan on the system to detect and eradicate the current threat
• B) Start a network capture on the system to look into the DNS requests to validate command and control traffic
• C) Shut down the system to prevent further degradation of the company network
• D) Reimage the machine to remove the threat completely and get back to a normal running state
• E) Isolate the system on the network to ensure it cannot access other systems while evaluation is underway

---

Definitions:

Normal Populations

Refers to populations that follow a normal (Gaussian) distribution, with data symmetrically distributed around the mean.

Fertilizer Effectiveness

The impact of fertilizers on promoting plant growth, health, and yield, typically assessed through scientific experiments.

Wilcoxon Rank-sum Test

A nonparametric statistical test used to compare the medians of two independent samples, especially when the data are not normally distributed.

Kruskal-Wallis Test

A method that does not rely on parameter assumptions to determine if samples come from the same distribution, employed when the conditions for ANOVA are not satisfied.