Which of the following are the BEST actions the analyst can take to stop any further compromise?

CORRECT TEXT

While investigating an incident in a company’s SIEM console, a security analyst found hundreds of failed SSH login attempts, which all occurred in rapid succession. The failed attempts were followed by a successful login on the root user Company policy allows systems administrators to manage their systems only from the company’s internal network using their assigned corporate logins.

Which of the following are the BEST actions the analyst can take to stop any further compromise? (Select TWO).

A Configure /etc/sshd_config to deny root logins and restart the SSHD service.

B. Add a rule on the network IPS to block SSH user sessions

C. Configure /etc/passwd to deny root logins and restart the SSHD service.

D. Reset the passwords for all accounts on the affected system.

E. Add a rule on the perimeter firewall to block the source IP address.

F. Add a rule on the affected system to block access to port TCP/22.

View Answer

Answer: D, E