If the processing strategy for SMTP virus files is set to alert, which of the following options is correct?

• A. Add announcement and generate log
• B. Delete the content of the email attachment
• C. Generate logs and forward them
• D. Generate logs and discard

In the penetration stage of an APT attack, which of the following attack behaviors will the attacker generally have?

• A. Through phishing emails, attachments with 0day vulnerabilities are carried, causing the user's terminal to become a springboard for attacks.
• B. Long-term latency and collection of key data.
• C. The attacker sends a C&C attack or other remote commands to the infected host to spread the attack horizontally on the intranet.
• D. Leak the acquired key data information to a third party of interest
  155955cc-666171a2-20fac832-0c042c044

The network-based intrusion detection system is mainly used to monitor the information of the critical path of the network in real time, listen to all packets on the network, collect data, and divide Analyze the suspicious object, which of the following options are its main features? (multiple choices)

• A. It can detect the source address and destination address, identify whether the address is illegal, and locate the real intruder.
• B. Good concealment, the network-based monitor does not run other applications, does not provide network services, and may not respond to other computers, so Not vulnerable to attack.
• C. The monitoring speed is fast (the problem can be found in microseconds or seconds, and the host-based DS needs to take an analysis of the audit transcripts in the last few minutes
• D. Need a lot of monitors.

When the account assigned by the administrator for the guest is connected to the network, the audit action that the administrator can perform on the guest does not include which of the following options?

• A. Account deactivation 1 reset Password
• B. Visitor online and offline records
• C. Send a warning message to the user
• D. Force users to go offline