Exam 350-201 topic 1 question 122 discussion

Actual exam question from Cisco's 350-201

Question #: 122
Topic #: 1

A SOC team is investigating a recent, targeted social engineering attack on multiple employees. Cross-correlated log analysis revealed that two hours before the attack, multiple assets received requests on TCP port 79. Which action should be taken by the SOC team to mitigate this attack?

A. Disable BIND forwarding from the DNS server to avoid reconnaissance.
B. Disable affected assets and isolate them for further investigation.
C. Configure affected devices to disable NETRJS protocol.
D. Configure affected devices to disable the Finger service.

Show Suggested Answer

Suggested Answer: D 🗳️

by Bobster02 at Jan. 2, 2022, 2:06 p.m.

Comments

Submit Cancel

27ea763

4 months, 4 weeks ago

Selected Answer: D

D as por TCP 79 refers to Finger

upvoted 1 times

...

DrVoIP

10 months ago

he correct answer is D. Configure affected devices to disable the Finger service. TCP port 79 is associated with the Finger protocol, which is a service that is commonly used by attackers to gather information about users and assets. The best way to mitigate this attack is to disable the Finger service on affected devices to prevent further reconnaissance by attackers. It is also recommended to investigate the source of the requests on TCP port 79 to identify any potential indicators of compromise and further harden the organization's security posture. - ChatGPT

upvoted 1 times

...