ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 489 - SY0-601 discussion

Report
Export

An organization experiences a cybersecurity incident involving a command-and-control server. Which of the following logs should be analyzed to identify the impacted host? (Select two).

A.
Application
Answers
A.
Application
B.
Authentication
Answers
B.
Authentication
C.
Error
Answers
C.
Error
D.
Network
Answers
D.
Network
E.
Firewall
Answers
E.
Firewall
F.
System
Answers
F.
System
Suggested answer: D, E

Explanation:

Network and firewall logs should be analyzed to identify the impacted host in a cybersecurity incident involving a command-and-control server. A command-and-control server is a central server that communicates with and controls malware-infected devices or bots. A command-and-control server can send commands to the bots, such as downloading additional malware, stealing data, or launching attacks. Network logs can help to identify any suspicious or anomalous network traffic, such as connections to unknown or malicious domains, high-volume data transfers, or unusual protocols or ports. Firewall logs can help to identify any blocked or allowed traffic based on the firewall rules, such as connections to or from the command-and-control server, or any attempts to bypass the firewall.

Reference:

https://cybersecurity.att.com/blogs/security-essentials/command-and-control-server-detection-methods-best-practices

https://www.howtogeek.com/726136/what-is-a-command-and-control-server-for-malware/

asked 02/10/2024
Joshua Muentes
46 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first