Exam CS0-002 topic 1 question 132 discussion

D looks correct.

detect is to identify........D

D because they are stil in thh Identification Phase

A little tip i've found with questions like this is to look for a keyword in each of the answers and then match that with the IR life cycle. - Escalate - Remove - Block - Identify In the Detection & Analysis phase we are looking into "potential" malware activity we are going to want to "Identify" before we Escalate, Block or Remove.

I don't think C is a detection phase. as the question states.

NEXT step during the "detection phase"

Creating a correlation search in the Security Information and Event Management (SIEM) system based on the network traffic can help the team identify potentially affected systems and gather more information on the behavior of the malware. This step will also help the team to determine the scope of the incident and prioritize their response efforts accordingly. Engage the engineering team to block SMB traffic internally and outbound HTTP traffic to the five IP addresses, is not the immediate next step as the team needs to gather more information before engaging other teams and blocking traffic.

I'm going for D. The question mentioned "potential malware". We don't know yet if it's really malware. Next step is finding out the behavior if it's malicious. If the question states that malware is detected then we would immediately do the C.

Answer is C: Based on this by CompTIA: "Detection and Analysis—Determine whether an incident has taken place and assess how severe it might be (triage), followed by notification of the incident to stakeholders." We already did an initial assessment and based on the findings, it needs to be "triaged", which is still in the detection phase. Which is why C is the best answer. This thing is actively beaconing out, you need to take action on this first, then go to D. So that is my reasoning for choosing C.

D. It specifically mentions "detection" phase.

Going with D. "NEXT step during the detection phase"

D due to the wording of the question

"during the detection phase of this response process", so it needs to take action D. After that option C can be taken with the process completed through SIEM.

What is asked here is the detection phase not the solution. so D is the best choice according to me

"during the detection phase".... Definitely D.

looks good to me

going with D