Exam 312-50v12 topic 1 question 243 discussion

965 Evading Signature-Based Detection Systems APT attacks are closely related to zero-day exploits, which contain malware that has never been previously discovered or deployed. Thus, APT attacks can easily bypass security mechanisms such as firewalls, antivirus software, IDS/IPS, and email spam filters.

A. Investigate for anomalies in file movements or unauthorized data access attempts within your database system

A, file movement or unauthorized access

Advanced Persistent Threats (APTs) often involve long-term, stealthy attacks aimed at unauthorized access and data exfiltration. One common characteristic is the persistence and subtle nature of these threats. Investigating anomalies in file movements or unauthorized data access attempts within the database system can help detect and confirm the presence of an APT. Monitoring for unusual patterns or activities within the database system is crucial in identifying and mitigating advanced and persistent threats.

A. Investigate for anomalies in file movements or unauthorized data access attempts within your database system Module 07 page 965

I think A, C, D are correct. Prioritize actions related to monitoring file movements, detecting zero-day exploits, and investigating spear-phishing attempts.

965 Evading Signature-Based Detection Systems APT attacks are closely related to zero-day exploits, which contain malware that has never been previously discovered or deployed. Thus, APT attacks can easily bypass security mechanisms such as firewalls, antivirus software, IDS/IPS, and email spam filters.

B. Scrutinize for repeat network login attempts from unrecognized geographical regions

I'd pick A since APT is not only through zero-day exploits, it can be through other method like social engineering as well. In my opinion, Option C kind of limit our investigation.

It is "A", page 648

It is "A", page 648

why not A?