A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user's laptop while traveling. The attacker has the user's credentials and is attempting to connect to the network. What is the next step in handling the incident?
A) Block the source IP from the firewall
B) Perform an antivirus scan on the laptop
C) Identify systems or services at risk
D) Identify lateral movement

Question

Quizplus · Accepted Answer

Identify systems or services at risk because the attacker may have access to other systems or services on the network.

A SIEM Tool Fires an Alert About a VPN Connection