CS0-003 Question 84

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C3

  Not only is the answer clearly understandable when looking at BanesTech comment but also understand what FIM does and now you can play process of elimination. Not be because that would be alerted by network monitoring not file integrity. Not D because definitely not file integrity. We wouldn't have an alert in FIM about IP. Between A and C, A is less likely because FIM monitors for programs and files already installed to ensure they haven't been tampered with. In addition, this alert doesn't tell us that something was downloaded by the threat actor. Hope that helps.

• Chose C20

  The suspicious activity described in the alert is: C. A new program has been set to execute on system start. This is indicated by the entry: ``` Host: Webserver01 Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Key Added: RunME (%appdata%\abc.exe) ``` which shows that a new registry key (`RunME`) was added under `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`, pointing to an executable file (`%appdata%\abc.exe`), indicating that a program has been configured to run automatically when the system starts.

• 2

  FIM- File integrity monitoring -