Exam CS0-003 topic 1 question 251 discussion

Actual exam question from CompTIA's CS0-003

Question #: 251
Topic #: 1

The SOC received a threat intelligence notification indicating that an employee’s credentials were found on the dark web. The user’s web and log-in activities were reviewed for malicious or anomalous connections, data uploads/downloads, and exploits. A review of the controls confirmed multifactor authentication was enabled. Which of the following should be done first to mitigate impact to the business networks and assets?

A. Perform a forced password reset.
B. Communicate the compromised credentials to the user.
C. Perform an ad hoc AV scan on the user's laptop.
D. Review and ensure privileges assigned to the user’s account reflect least privilege.
E. Lower the thresholds for SOC alerting of suspected malicious activity

Show Suggested Answer

Suggested Answer: A 🗳️

by Chiniwini at July 28, 2024, 5:04 p.m.

Comments

Submit Cancel

Chiniwini

Highly Voted 1 year ago

Selected Answer: A

Perform a forced password reset: This is the most immediate and effective action to ensure that the compromised credentials cannot be used. Even if MFA is enabled, resetting the password will render the stolen credentials useless, preventing potential unauthorized access. The primary goal is to prevent any unauthorized access using the compromised credentials. Performing a forced password reset immediately addresses this concern, making A. Perform a forced password reset the first and most critical action to take.

upvoted 9 times

...