An EDR solution reports that a suspicious process dropped a malicious file on endpoint DE23X5940P.
Sandbox analysis shows that the malware propagates through SMB and communicates through an encrypted command-and-control channel. A business-critical solution also depends on SMB. Which action should the security analyst take to respond to the incident and mitigate risk?

• A. Deploy an SSL-inspection solution and remove the malware.
• B. Isolate the machine and block the command-and-control IP address.
• C. Disable SMB communications on all networks.
• D. Reimage the machine and reset the user's credentials.

A data breach was recently experienced in which sensitive customer information was exfiltrated by an insider.
After the incident was contained and affected customers were notified, a post-incident analysis was conducted to identify the root cause of the breach and develop recommendations to prevent similar incidents in the future. Which action should an engineer recommend?

• A. Update antivirus software and conduct a full system scan on all devices connected to the organization's network.
• B. Require all employees to change their passwords and enforce a stronger password policy with rotation.
• C. Conduct a penetration test of the network and systems to identify potential vulnerabilities and recommend mitigations.
• D. Implement DLP software to monitor and control the flow of sensitive information across the organization.

Refer to the exhibit.

During static analysis of the potentially malicious executable obpdisp.exe, a SOC analyst identifies several functions used by the executable. Which step should the analyst take next to investigate and understand the threat further?

• A. Create a named mutex object to prevent the malware from running multiple instances.
• B. Ignore the file because static analysis has not identified anything unusual in the sample.
• C. Retrieve the address of an exported function to understand the malware's API interactions.
• D. Conduct dynamic analysis to observe the malware's behavior in a controlled environment.

What is the transmogrify anti-forensics technique?

• A. hiding a section of a malicious file in unused areas of a file
• B. sending malicious files over a public network by encapsulation
• C. changing the file header of a malicious file to another file type
• D. concealing malicious files in ordinary or unsuspecting places