An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation. What information should be taken from this report for the investigation?
A.
client applications by user, web applications, and user connections
B.
number of attacked machines, sources of the attack, and traffic patterns
C.
threat detections over time and application protocols transferring malware
D.
intrusion events, host connections, and user sessions
The Firepower System correlates various types of data (intrusion events, Security Intelligence, connection events, and file or malware events) to determine whether a host on your monitored network is likely to be compromised by malicious means. Certain combinations and frequencies of event data trigger indications of compromise (IOC) tags on affected hosts.
https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/using_host_profiles.html#ID-2218-000003be
I verified this in the lab.
Perhaps this is a question about the contents of the “host report” that is provided as a template for FMC's Reporting.
The following five items are included in the Host Report.
- Applications being used and served by the host
- Intrusion Events that the host has been involved with
- Connections that the host has established
- Users of the host
- White list violations by the host
Therefore, the answer should be D.
(A seems to be an explanation of another Report Template called “User Report”.)
Correct answer is D. intrusion events, host connections, and user sessions
upvoted 3 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
SegaMasterSystemAdmin
Highly Voted 1Â year, 1Â month agotinyJoe
Most Recent 3Â weeks agoTHEODORABLE
1Â year, 2Â months agoKISRUVEM
6Â months, 1Â week agoInitial14
1Â year, 3Â months agoneo_911
1Â year, 3Â months ago