Cisco Updated 200-201 Exam Questions and Answers by apollo

Persistence mechanisms allow attackers to maintain access to a compromised system across reboots, logoffs, or security events. In Windows environments, two of the most common and well-documented persistence techniques involve Registry Run keys and scheduled tasks.

The exhibit highlights several indicators of compromise, including new Registry entries under the Run key and newly created scheduled tasks that execute during non-business hours. Registry Run keys enable programs to execute automatically when the system or user starts, making them a frequent target for malware and attackers seeking long-term access. Similarly, Task Scheduler allows attackers to execute malicious code at predefined times or events, often designed to evade detection.

Analyzing both the Windows Registry changes and Task Scheduler tasks directly targets these persistence mechanisms. This aligns with host-based analysis best practices, which prioritize startup execution points and scheduled execution artifacts when persistence is suspected.

The other options are incomplete or misaligned. Windows Defender status and login attempts may indicate security tampering or brute-force activity, but they do not directly reveal persistence techniques. User account logins alone do not explain automated re-execution of malicious code, and deleting Run keys without full analysis risks destroying forensic evidence.

Therefore, focusing on Registry changes and Task Scheduler tasks provides the most accurate and operationally sound method for uncovering attacker persistence.

The ‘detection and analysis’ phase of incident response includes identifying all hosts affected by an attack. This step involves analyzing the scope of the incident, determining which systems and data are impacted, and understanding the nature of the attack to inform subsequent containment and eradication efforts45.

References :=

CrowdStrike’s overview of incident response frameworks and steps4.

VCEGuide’s explanation of incident response steps

Decision making is a principle that guides an analyst to gather information relevant to a security incident to determine the appropriate course of action. Decision making involves identifying the problem, defining the criteria, analyzing the alternatives, and choosing the best solution. Decision making helps an analyst to respond to an incident effectively and efficiently, while minimizing the impact and risk to the organization. References: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1.0/CSCU-LP-CBROPS-V1-028093.html (Module 3: Security Monitoring, Lesson 3.1: Security Operations Center)