A security analyst notices a number of SIEM events that show the following activity:10/30/2020 -...

CompTIA CAS-005 Question Answer

A security analyst notices a number of SIEM events that show the following activity:

10/30/2020 - 8:01 UTC - 192.168.1.1 - sc stop HinDctend

10/30/2020 - 8:05 UTC - 192.168.1.2 - c:\program files\games\comptidcasp.exe

10/30/2020 - 8:07 UTC - 192.168.1.1 - c:\windows\system32\cmd.exe /c powershell

10/30/2020 - 8:07 UTC - 192.168.1.1 - powershell —> 40.90.23.154:443

Which of the following response actions should the analyst take first?

Disable powershell.exe on all Microsoft Windows endpoints

Restart Microsoft Windows Defender

Configure the forward proxy to block 40.90.23.154

Disable local administrator privileges on the endpoints

CAS-005 PDF/Engine

Get 65% Discount on All Products, Use Coupon: "ac4s65"