Exam CAS-004 topic 1 question 237 discussion

Since the system is completely air-gapped and closed, external files should not have been able to upload to the critical server. Therefore, the most likely cause of the anomalous files is an insider threat. Given that, the most effective process to expose an attacker would be to review video from IP cameras within the facility, as it can help identify any unusual behavior or activity by individuals who may have accessed the server. Therefore, the correct answer is A. Reviewing video from IP cameras within the facility.

agree with A

A. Reviewing video from IP cameras within the facility Since the system is completely air-gapped and closed, it is unlikely that the attacker gained access through the network. Reviewing video footage from IP cameras within the facility may provide clues to the source of the breach, such as someone physically accessing the server or using unauthorized devices (e.g., USB drives) to introduce the anomalous external files.

Air gaped so only physical access was possible

Looking for privileged credential reuse on the network is the most likely process that would expose an attacker. The anomalous external files on the server suggest that the attacker gained access to the system. Therefore, the attacker must have had privileged credentials or access that allowed them to upload the files. By looking for privileged credential reuse on the network, the administrator can identify any credentials that have been compromised and potentially used by the attacker to gain access to the system. This information can be used to revoke compromised credentials, change passwords, and implement additional security measures to prevent future attacks.

A easy