Indicator of Compromise (IoC)

Correct Answer: DDoS attack

The continuous connections from an unknown IP suggest a potential Distributed Denial of Service (DDoS) attack on the system, causing slow network performance. The other options do not directly relate to the continuous connections from an unknown IP and slow network performance.

Correct Answer: Increased network traffic

Increased network traffic is the most indicative IoC for unauthorized access to a file server by a remote user. When an attacker gains unauthorized access to a file server, they typically attempt to exfiltrate data by downloading large files or volumes of information. This activity results in a noticeable spike in network traffic, especially if the attacker is transferring significant amounts of data. While failed logon attempts might occur during the initial intrusion phase, successful unauthorized access would not necessarily generate multiple failed attempts. New administrator accounts, unusual email attachments, unusual DNS requests, and unused software installations are less directly related to the specific scenario of unauthorized file server access and data exfiltration.

Correct Answer: Investigate the unfamiliar IP address

Investigating the unfamiliar IP address is the best response as it allows the analyst to gather more information on the potential Indicator of Compromise (IoC). Blocking the IP may result in loss of legitimate traffic, ignoring it could lead to further security risks, and the other measures are too disruptive without enough information to warrant their use.