A Cybersecurity Analyst Is Investigating a Potential Incident Affecting Multiple

Multiple Choice

A cybersecurity analyst is investigating a potential incident affecting multiple systems on a company's internal network. Although there is a negligible impact to performance, the following symptoms are present on each of the affected systems: Existence of a new and unexpected svchost.exe process Persistent, outbound TCP/IP connections to an unknown external host with routine keep-alives transferred DNS query logs showing successful name resolution for an Internet-resident dynamic DNS domain If this situation remains unresolved, which of the following will MOST likely occur?

A) The affected hosts may participate in a coordinated DDoS attack upon command
B) An adversary may leverage the affected hosts to reconfigure the company's router ACLs
C) Key files on the affected hosts may become encrypted and require ransom payment for unlock
D) The adversary may attempt to perform a man-in-the-middle attack