Exam CS0-003 topic 1 question 263 discussion

C. Containment Explanation: Containment involves isolating the compromised system to prevent the attack from spreading further or causing more damage. In this case, containing the compromised email server would be crucial to stopping any further unauthorized access, spam, or malware distribution within the network.

Containment - always immediately follows after detection. Took my CASP and passed.

The one-liner observed in the SIEM alert indicates that the attacker is using PowerShell to download and execute a remote script from an external IP address. • rundll32.exe: A common Windows utility, often misused by attackers to execute arbitrary code. • JavaScript and ActiveXObject: The attacker uses this to execute commands on the system. • PowerShell: With parameters to avoid profile loading and disable execution policy (-ep bypass), allowing the execution of potentially untrusted scripts. • Download and execution of a script: The PowerShell Invoke-Expression (IEX) is used to download and run the script AccessToken.ps1 from an external IP. Best description of the attacker’s intent: C. Attacker is executing PowerShell script “AccessToken.ps1”.

The incident has already been detected and analyzed, so the next step is containment.