A bank intrusion alert includes a source address and a destination address, and the destination is the bank payroll server. Which address is the asset to scope first?
Select an answer to reveal the explanation.
Short Explanation
When an alarm names a vault, you go to the vault, not to a random house, your own laptop, or the locksmith. The destination in this alert is the bank payroll server, and that internal asset is what you scope first. The trap is chasing an unrelated home router, the analyst laptop, or the certificate authority.
Full Explanation
The alert names a source address and a destination address, and the destination is the bank payroll server. The asset to scope first is that internal system, the one the alert places in the bank. The address to scope is "The destination payroll server, the internal asset named by the alert and the system to scope first". A home router that the alert does not identify is not the asset, so "A random home router that has no role in the payroll alert the bank received" fails. The analyst laptop is the tool used to read the alert. It is not the system the alert is about, so "The analyst laptop, treated as the system this payroll alert is actually about" fails. The certificate authority signed a certificate. It is not the payroll asset named as the destination, so "The certificate authority that signed the certificate on the payroll server" fails. Exam caveat: scope the internal payroll asset the alert names before spending the case on a home router, an analyst laptop, or a certificate authority the alert did not identify. Operational check: confirm the destination address in the alert is the payroll server and open the case on that host.