An Incident Responder observes an incident with multiple malware downloads from a malicious domain. The domain in question belongs to one of the organization's suppliers. The organization needs access to the site to continue placing orders. ATP: Network is configured in Inline Block mode. How should the Incident Responder proceed?
A) Whitelist the domain and close the incident as a false positive
B) Identify the pieces of malware and blacklist them, then notify the supplier
C) Blacklist the domain and IP of the attacking site
D) Notify the supplier and block the site on the external firewall

Question

Quizplus · Accepted Answer

The Incident Responder should notify the supplier about the malicious activity and block the site on the external firewall to prevent further malware downloads while the issue is being resolved.

An Incident Responder Observes an Incident with Multiple Malware Downloads