Exam CS0-002 topic 1 question 52 discussion

Sinkhole the domains would be best for INTELLIGENCE GATHERING but updating the blacklist would be the best way to prevent future issues. So i would assume Sinkhole is what they want.

"intelligence gathering"

C. Sinkhole the domains. In this scenario, sinkholing the domains would be the most appropriate configuration change for intelligence gathering. Sinkholing involves redirecting traffic from malicious domains to a controlled infrastructure, allowing security professionals to monitor and analyze the malicious activity without exposing the targeted individuals to actual threats. This helps in gathering intelligence on the tactics, techniques, and procedures (TTPs) of the potential threat actors. The other options, such as updating the whitelist, developing a malware signature, or updating the blacklist, are more focused on reactive measures and may not be as effective in gathering intelligence on the threat actors and their activities. Sinkholing, on the other hand, provides an opportunity for proactive intelligence gathering while protecting the targeted individuals from potential harm.

Like many others said "INTELLIGENCE GATHERING" are the keywords to choose C

D is the correct answer... why sinkhole? You are not asked to investigate it further...it was already investigated by a trusted source.

If you are trying to gather intelligence, you would Sinkhole. (C)

Just read this not too long - Sinkholing it is: [ C ]

"A sinkhole is a server designed to capture malicious traffic and prevent control of infected computers by the criminals who infected them" https://www.wired.com/story/what-is-sinkholing/

D sounds right