Exam 350-201 topic 1 question 13 discussion

I think its B. The only thing we know is the user noticed a change. Gathering evidence and logs would be my move, escalating too soon migth not be good.

ChatGPT: At this stage in the incident response workflow, it is essential to determine how the attack occurred, assess its impact, and identify vulnerabilities to mitigate further damage.

When an incident response team receives a report of unexpected changes within software, the immediate steps involve classifying the attack vector, understanding the scope of the event, and identifying the vulnerabilities being exploited. This is a critical part of the incident response workflow as it helps in determining the nature of the attack and the appropriate containment and eradication strategies3.

I think could be option D. Person that detected the anomaly is a payroll administrator don't think He could have an idea on how to classify the attack vector.

took the test today but failed. This is test question.

At this step in the incident response workflow, the following actions should be taken: C. Classify the attack vector, understand the scope of the event, and identify the vulnerabilities being exploited. The first priority of the incident response team should be to gain a full understanding of the incident. This includes identifying the attack vector, understanding the scope of the event, and identifying the vulnerabilities being exploited. By classifying the attack vector and determining the scope of the event, the incident response team can begin to determine the level of response needed and whether additional resources or expertise may be necessary to address the incident. Then A followed by B

ITs C for sure. Read the NIST handbook before you assume things.. The incident response team should work quickly to analyze and validate each incident, following a predefined process and documenting each step taken. When the team believes that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope, such as which networks, systems, or applications are affected; who or what originated the incident; and how the incident is occurring (e.g., what tools or attack methods are being used, what vulnerabilities are being exploited). The initial analysis should provide enough information for the team to prioritize subsequent activities, such as containment of the incident and deeper analysis of the effects of the incident.

Answer C.

Answer is B

Its B for me, D can´t be, the incident was already escalated to the Incident Response team

I think C this is identification so scope and areas impacted are part of this

D. Determine the attack surface, evaluate the risks involved, and communicate the incident according to the escalation plan - makes more sense.