An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worm's artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?
Which of the following is the best way to establish and verify the integrity of a file before copying it during an investigation?
A company estimates a loss of $2,374 per hour in sales if their website goes down. Their webserver hosting site's documented downtime was 7 hours each quarter over the last two years. Using the information, what can the analyst determine?
What does the following WMIC command accomplish?
process where name='malicious.exe' delete
A company classifies data using document footers, labeling each file with security labels ''Public'', ''Pattern'', or ''Company Proprietary''. A new policy forbids sending ''Company Proprietary'' files via email. Which control could help security analysis identify breaches of this policy?