During an Incident, a Company's CIRT Determines It Is Necessary

question 60

Multiple Choice

During an incident, a company's CIRT determines it is necessary to observe the continued network-based transactions between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?

• A) Physically move the PC to a separate Internet point of presence.
• B) Create and apply microsegmentation rules.
• C) Emulate the malware in a heavily monitored DMZ segment.
• D) Apply network blacklisting rules for the adversary domain.

---

Definitions:

Personality

A person's special mix of emotional, attitudinal, and behavioral reactions.

Cross-Cultural Research

Studies designed to compare and contrast cultures, exploring how values, behaviors, and norms differ and are the same across societies.

Harsh

Describes something or someone that is unpleasantly rough, severe, or cruel, often in a way that is shocking or difficult to accept.

Discipline Technique

Methods or strategies used to guide behavior and teach appropriate conduct, often applied in parenting or education.