Exam SY0-501 topic 1 question 881 discussion

Actual exam question from CompTIA's SY0-501

Question #: 881
Topic #: 1

During an incident, a company's CIRT determines it is necessary to observe the continued network-based transactions between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?

A. Physically move the PC to a separate Internet point of presence.
B. Create and apply microsegmentation rules.
C. Emulate the malware in a heavily monitored DMZ segment.
D. Apply network blacklisting rules for the adversary domain.

Show Suggested Answer

Suggested Answer: BA 🗳️

by Teza at Aug. 23, 2020, 11:57 p.m.

Comments

Submit Cancel

steven1

Highly Voted 4 years, 9 months ago

B. could do it, and would be the best option so they can study the malware. 'Micro-segmentation is a network security technique that enables security architects to logically divide the data center into distinct security segments down to the individual workload level, and then define security controls and deliver services for each unique segment.' A. could be a temp solution until the segmentation is done (if there are two answers).

upvoted 11 times

...

Hanzero

Highly Voted 4 years, 9 months ago

tf two choices?

upvoted 9 times

...

KelvinYau

Most Recent 7 months, 3 weeks ago

Selected Answer: C

wtf, 2 ans?

upvoted 1 times

...

love310bus

1 year, 12 months ago

C."Emulate the malware in a heavily monitored DMZ segment" it provides an isolated environment for the malware to run.

upvoted 1 times

...

abd1234

3 years ago

Selected Answer: B

per the comments from others

upvoted 1 times

...

fonka

3 years, 11 months ago

Yes b Organizations that adopt microsegmentation realize tangible benefits in the form of a reduced attack surface, improved breach containment, stronger compliance posture and streamlined policy management.

upvoted 1 times

...