A Network Administrator Is Unable to Identify the Root Cause

question 254

Multiple Choice

A network administrator is unable to identify the root cause of a network incident because insufficient evidence about the threat actor's actions was logged. The administrator notes that the server receiving and storing the events was not compromised by any attack and is properly communicating with all network devices. Which of the following can the administrator employ to improve network access accountability?

• A) Activate the audit logs on the network server and resources.
• B) Configure SNMP on the network server.
• C) Deploy a central SIEM server into the network.
• D) Collect traffic statistics from the servers using NetFlow data.

---

Definitions:

Retracing Steps

A method of attempting to remember or find something by thinking or going back over the path or actions taken.

Identification

A psychological process whereby an individual assimilates an aspect, property, or attribute of another and is transformed, wholly or partially, by the model the other provides.

Implicit Memory

Memory that enhances task execution using prior experiences, without the individual consciously realizing those past experiences.

Iconic Memory

A form of sensory memory that temporarily holds visual images before they fade or are processed further.