During an Incident, a Company's CIRT Determines It Is Necessary

question 60

Multiple Choice

During an incident, a company's CIRT determines it is necessary to observe the continued network-based transactions between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?

• A) Physically move the PC to a separate Internet point of presence.
• B) Create and apply microsegmentation rules.
• C) Emulate the malware in a heavily monitored DMZ segment.
• D) Apply network blacklisting rules for the adversary domain.

---

Definitions:

Treasury Stock

Treasury stock refers to shares that were issued and subsequently reacquired by the issuing company, reducing the amount of outstanding stock on the open market.

Reissuance

The process of re-releasing previously issued shares back into the market, often after they've been bought back by the company.

Treasury Stock

Shares that were once issued and outstanding but were later bought back by the company, reducing the amount of outstanding stock on the open market.

Cash Dividend

A payout from a corporation's profits, determined by its board of directors, provided to a specific group of its stockholders as cash.