Cisco Cyber Security Practice Exam

What action should an organization take to find out if their systems have been compromised after identifying a backdoor?

1. Update antivirus software

2. Look for unauthorized accounts

3. Conduct a data backup

4. Encrypt sensitive files

The correct answer is: Look for unauthorized accounts

Identifying unauthorized accounts is a crucial step for an organization to assess the extent of a potential compromise after discovering a backdoor. Backdoors often provide attackers with means to gain access to systems, and one common tactic is creating unauthorized user accounts. By examining the system for any accounts that should not exist, the organization can uncover evidence of unauthorized access or malicious activity. This action allows the organization to identify potential breaches and understand how the backdoor was accessed, helping them to formulate a more effective incident response strategy. While updating antivirus software, conducting data backups, and encrypting sensitive files are all relevant security measures, they are not as immediate and direct in determining the compromise's presence. Updating antivirus may help in detecting known threats but does not confirm unauthorized access. Backups are essential for recovery purposes but do not address the issue of current compromise. Encrypting files enhances data security but does not directly relate to finding out whether a backdoor has led to unauthorized entry. Thus, investigating unauthorized accounts is a pivotal action in response to a discovered backdoor.