A Security Administrator Receives Alerts from the Perimeter UTM

question 999

Multiple Choice

A security administrator receives alerts from the perimeter UTM. Upon checking the logs, the administrator finds the following output: Time: 12/25 0300 From Zone: Untrust To Zone: DMZ Attacker: externalip.com Victim: 172.16.0.20 To Port: 80 Action: Alert Severity: Critical When examining the PCAP associated with the event, the security administrator finds the following information: <script> alert ("Click here for important information regarding your account! http://externalip.com/account.php ") ; </script> Which of the following actions should the security administrator take?

• A) Upload the PCAP to the IDS in order to generate a blocking signature to block the traffic.
• B) Manually copy the <script> data from the PCAP file and generate a blocking signature in the HIDS to block the traffic for future events. Manually copy the <script> data from the PCAP file and generate a blocking signature in the HIDS to block the traffic for future events.
• C) Implement a host-based firewall rule to block future events of this type from occurring.
• D) Submit a change request to modify the XSS vulnerability signature to TCP reset on future attempts.

---

Definitions:

Contribution Margin

The portion of sales income available to cover fixed expenses and contribute to net profit, after covering all variable expenses.

Financial Advantage

The benefit gained in financial terms, which might include profitability, revenue growth, or value creation, compared to a baseline or competitors.

Fixed Manufacturing Expenses

These are the expenses that remain constant regardless of the amount of goods produced, including rent for factory buildings or lease payments for manufacturing equipment.

Fixed Selling

Expenses that remain constant regardless of the level of sales or production, such as salaries of sales managers and rental charges of retail spaces.