Performing CyberOps Using Cisco Security Technologies (CBRCOR) — Question 4

The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?

Answer options

• A. Determine the assets to which the attacker has access
• B. Identify assets the attacker handled or acquired
• C. Change access controls to high risk assets in the enterprise
• D. Identify movement of the attacker in the enterprise

Correct answer: D

Explanation

The correct answer is D because understanding the intruder's movements can help identify any potential threats or further unauthorized access within the premises. Options A and B focus on assets related to the attacker but do not address immediate security concerns. Option C may be necessary later but does not directly relate to analyzing this specific incident.