User behavior analysis (UBA) is the most effective method for detecting abnormal account activity.
* UBA uses machine learning and behavioral analytics to identify patterns in how users interact with systems. If an employee suddenly logs in from an unusual location or accesses resources outside of their normal behavior, it raises an alert.
* Option A (Malicious command interpretation) is focused on malware analysis, not user behavior.
* Option B (Network monitoring) detects anomalies at the network level, but does not specifically focus on user behaviors.
* Option D (SSL Inspection) is useful for decrypting encrypted traffic, but it does not analyze user activity patterns.

Using aregular expression (regex)to search email logs is the most efficient and scalable way to identify patterns in phishing URLs. Phishing campaigns often use consistent URL formats across different domains.
Regex allows administrators to define flexible patterns to match these URLs even when the domains vary.
This is significantly more effective than relying on user reports or less granular tools like firewall logs for such cases.
Reference:
Chapple & Seidl,CompTIA CySA+ Study Guide(Sybex, 2023), Chapter 3: Regular expressions are commonly used for identifying patterns in log data and filtering results for security analysis

* D (4: HTTPS traffic to an external IP - 5.29.1.5)
* The log entry shows an internal system (172.16.1.30) communicating with an external IP (5.29.1.5) overTCP 443 (HTTPS)usingBrowser.exe.
* HTTPS traffic to an unknown external IP could indicate data exfiltration, as attackers often use encrypted channels to disguise stolen data transfers.
* G (7: FTP traffic to an external backup server - bank.backup.com)
* The log entry indicates that an internal machine (172.16.1.25) is transferring data tobank.backup.
comusingFTP (port 21)andFileZilla.
* FTP is a major concern because it is an outdated, unencrypted protocolthat can be exploited for data exfiltration. If unauthorized, this could be a serious data breach.
Other Options:
* A (ARP traffic) # Not a concern(Just address resolution)
* B (RPC Kerberos traffic) # Normal for authentication
* C (SMB traffic) # Internal file sharing
* **E (DNS traffic) # Common, though could be exfiltration in some cases, but not in this log)
* F (WUS traffic) # Appears to be Windows Update Service traffic, likely legitimate Reference: CompTIA CySA+ CS0-003, Chapter 5: " Network Security Monitoring and Analysis, " Section: " Detecting Data Exfiltration "

A risk register typically contains details like ID, name, description, classification of information, and responsible party. It's used for tracking identified risks and managing them. Recording details like ID, Name, Description, Classification of information, and Responsible party is typically done in a Risk Register. This document is used to identify, assess, manage, and monitor risks within an organization. It's not directly related to incident response or change control documentation.

OWASP ZAP (Zed Attack Proxy) is a tool recommended for quickly testing web applications for vulnerabilities, including SQL injection, path traversal, and cross-site scripting. It is an open-source web application security scanner that helps identify security issues in web applications during the development and testing phases.