Command-and-control (C2) beaconing involves compromised systems communicating with an attacker's server at regular intervals, often using HTTPS to blend in with legitimate traffic. This is indicative of a potential compromise where malware communicates back to a command center. The persistent nature of the connections after hours and throughout the day suggests automated beaconing, which is a tell-tale sign of C2 activity. According to CompTIA CySA+, this type of activity should raise immediate suspicion and warrants further investigation and containment. While options B, C, D, and E might indicate other issues, they do not fit the pattern described as well as option A.

The correct answer is C. Impact.
The impact metric is the best way to measure the degree to which a system, application, or user base is affected by an uptime availability outage. The impact metric quantifies the consequences of the outage in terms of lost revenue, productivity, reputation, customer satisfaction, or other relevant factors. The impact metric can help prioritize the recovery efforts and justify the resources needed to restore the service1.
The other options are not the best ways to measure the degree to which a system, application, or user base is affected by an uptime availability outage. The timeline metric (A) measures the duration and frequency of the outage, but not its effects. The evidence metric (B) measures the sources and types of data that can be used to investigate and analyze the outage, but not its effects. The scope metric (D) measures the extent and severity of the outage, but not its effects.

Aplaybookprovides astep-by-stepguide for handling specific types of incidents like ransomware, making it invaluable during triage. It outlines predefined procedures, aiding consistent and fast decision-making.
* The incident response plan (A) provides high-level structure.
* Lessons learned (B) applyafterthe incident.
* Tabletop exercises (D) are training tools, not live guides.
#Reference: Chapple & Seidl, CySA+ Practice Tests, Incident Response, Chapter 3 - Playbooks and Procedures.
#Objective: 3.1 - Apply incident response procedures based on an incident classification.

Automatingthe generation of NIDS (Network Intrusion Detection System) rulesbased onStructured Threat Information eXpression (STIX) messagesis apractical use of automationin security operations.
* Option B (Privileged access requests)should involve human oversight due to thehigh risk of unauthorized access.
* Option C (PKI identity verification)requires manualdocument verificationandhuman approval.
* Option D (Malware analysis)often requiressandboxing and behavioral analysis, which benefit from human expertise.
Thus,A is the correct answer, asautomating threat intelligence ingestion and rule creation enhances efficiency in intrusion detection.

The goal of forensic analysis in a post-incident scenario is to identify the root cause of the incident. This helps prevent future occurrences and enhances the security posture of the organization.
Option A (Full picture of risks) is more aligned with a risk assessment rather than forensic analysis.
Option B (Notifying law enforcement) depends on the situation, but forensic analysis is performed even when legal action is not involved.
Option C (Further containment) is part of incident response, but forensic analysis happens after containment.
Thus, D is the correct answer, as determining root cause is the key objective of forensic analysis.