Exam 312-50v11 topic 1 question 287 discussion

I think D is correct. Need check PC to find reason

The key factor here is that the alert happened after the block. The first logical thing to do is to verify that the traffic is actually being blocked, and what specifically triggered the alert at the IDS/IPS/firewall.

Once the PC is infected, the log may be tampered. So Event logs on the PC has (almost) no value.

Despite D might make sense too, I think that the next step for analyzing how it impacted the company should analyze the history of connections to that IP, and checking whether other endpoints have connected to those IPs.

Internet Firewall/Proxy log this Question was on CEHV10 Dump

I'd have to agree with the stated answer, my reading of the situation is... this is a smart IDS, it was updated with the blacklisted IP and caught the C2 channel straightaway but what that means for us is that we've lost control of our network officially. so now what? first thing I'd do is get to the firewall/proxy to correlate if and what malicious convos this compromised machine has been having recently (next steps of the hack, exfiltration of something, whatever) apart from all the other things this is the first move imho

Correct

This won't help get this question correct on the exam, but as a previous Forensic Analyst, once I have reason to believe a PC is popped, the first thing I do is grab the IDS logs for the PC's IP address, all the registry and evt(x) files, and other files of forensic interest, and create a super timeline in date/time sequence of all events combined into a single file. Based on this reasoning, you can argue for for "F.) All of the above."

I think is D In my opinion first of all we start by checking the pc after extending our investigation to other nodes for more visibility

correct option C