Question

As a security analyst for a large financial advisory corporation, you have been monitoring several host devices and have noticed an abnormal increase in processor usage. You believe that an attacker might be using these hosts to gain access to sensitive customer information.

What should you do before such attacks occur to help identify and investigate this type of abnormal activity?

answer

Check for a trail of file system metadata.


Monitor the overall percentage of memory usage.


Use a cryptography analysis tool to determine if the processing is abnormal.


Establish a baseline of normal CPU usage for all host devices.

Answer 1

Establish a baseline of normal CPU usage for all host devices.

Reason: Knowing normal CPU patterns lets you detect and investigate deviations (like sustained spikes) that may indicate compromise.