Exam 350-201 topic 1 question 99 discussion

Actual exam question from Cisco's 350-201

Question #: 99
Topic #: 1

A threat actor has crafted and sent a spear-phishing email with what appears to be a trustworthy link to the site of a conference that an employee recently attended. The employee clicked the link and was redirected to a malicious site through which the employee downloaded a PDF attachment infected with ransomware. The employee opened the attachment, which exploited vulnerabilities on the desktop. The ransomware is now installed and is calling back to its command and control server. Which security solution is needed at this stage to mitigate the attack?

A. web security solution
B. email security solution
C. endpoint security solution
D. network security solution

Show Suggested Answer

Suggested Answer: D 🗳️

by jaciro11 at Aug. 31, 2022, 12:13 a.m.

Comments

Submit Cancel

hiro3316

3 weeks, 6 days ago

Selected Answer: C

At this point, the ransomware has already been installed on the endpoint and is communicating with the command and control (C2) server.

upvoted 1 times

...

27ea763

4 months, 4 weeks ago

Selected Answer: D

I would go with Network Security, because the endpoint is already compromised.

upvoted 1 times

...

TrainingTeam

8 months ago

Selected Answer: C

At this stage of a ransomware attack, where the ransomware is installed and calling back to its command and control server, an endpoint security solution is needed to mitigate the attack. Endpoint security solutions can detect and respond to threats at the device level, isolate infected machines, and prevent the spread of ransomware within the network4.

upvoted 1 times

...

bpetro_12

1 year, 1 month ago

keywords are, "mitigate the attack"

upvoted 1 times

...

DrVoIP

2 years, 4 months ago

C - End point Security solution - ChatGPT

upvoted 3 times

...

ETSec

2 years, 5 months ago

Selected Answer: C

C. endpoint security solution Once the malware has been downloaded and executed on the endpoint, an endpoint security solution is needed to mitigate the attack. This type of solution can detect and prevent malicious activity on the endpoint, such as the encryption of files by ransomware. It may also be able to contain or remove the malware, and prevent further communication with the command and control server.

upvoted 1 times

...

jaciro11

2 years, 9 months ago

Selected Answer: D

For me would be EndPoint at this point what can I do when the computer is infected if I want to mitigate I would need to use endpoint security, sure I can kill the command and control with Network security but that dont will mitigate the device infected with the Ransomware itself. For me EndPoint Security Solution

upvoted 2 times

ETSec

2 years, 5 months ago

So answer C ;-)

upvoted 1 times

...