Free Preparation Discussions
MENU
Cisco 300-215 Exam - Topic 2 Question 112 Discussion
Topic #: 2
An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)
When suspicious activity is detected on a workstation, immediate steps need to be taken to preserve evidence and prevent further compromise:
Disconnecting the system from the network (C) is crucial to stop potential exfiltration of data or ongoing communications with a command-and-control server. This isolation prevents further spread or damage while preserving the state of the compromised system for further investigation.
Taking an image of the workstation (E) is part of the forensics acquisition process. It involves creating a bit-by-bit copy of the system's disk, which preserves all evidence in its current state. This allows for thorough forensic analysis without affecting the original evidence.
These steps align with the best practices outlined in the incident response and forensics processes (as described in the CyberOps Technologies (CBRFIR) 300-215 study guide). Specifically, in the Identification and Containment phases of the incident response cycle, it's emphasized that isolating the system and preserving evidence through imaging are critical to ensuring both containment of the threat and successful forensic investigation.
Nikita
3 days agoBarney
8 days agoBrynn
13 days agoCatherin
19 days agoNikita
24 days agoBarney
29 days agoBrynn
1 month agoCatherin
1 month agoLizette
1 month agoLonna
2 months agoSamira
2 months agoAsuncion
2 months agoCarlee
2 months agoMitsue
2 months agoSharmaine
4 months agoJosphine
4 months agoNoble
4 months ago