Exam 312-50v13 topic 1 question 243 discussion

To confirm and isolate an APT, you should prioritize investigating anomalies in file movements and unauthorized data access. This strategy targets the core behavior of APTs—persistent, stealthy actions aimed at data exfiltration and maintaining access to the network over time.

The best action to prioritize in confirming and isolating a potential Advanced Persistent Threat (APT) would be: A. Investigate for anomalies in file movements or unauthorized data access attempts within your database system. Here’s why: APTs are typically characterized by their stealthy, persistent nature and focus on long-term infiltration. They often involve gradual exfiltration of sensitive data, lateral movement through the network, and the use of non-obvious attack methods (e.g., leveraging legitimate credentials).